Virtual Browser: a Web-Level Sandbox to Secure Third-party Java']JavaScript without Sacrificing Functionality

被引：2

作者：

Cao, Yinzhi ^{[1
]}

Li, Zhichun ^{[1
]}

Rastogi, Vaibhav ^{[1
]}

Chen, Yan ^{[1
]}

机构：

[1] Northwestern Univ, Dept EECS, Evanston, IL 60208 USA

来源：

PROCEEDINGS OF THE 17TH ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY (CCS'10) | 2010年

关键词：

Third-party [!text type='Java']Java[!/text]Script; Web Security; Virtualization;

D O I：

10.1145/1866307.1866387

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

Third-party JavaScript offers much more diversity to Web and its applications but also introduces new threats. Those scripts cannot he completely trusted and executed with the privileges given to host web sites. Due to incomplete virtualization and lack of tracking all the data flows, all the existing works in this area can secure only a subset of third-party JavaScript. At the same time, because of the existence of not so well documented browser quirks, attacks may be encoded in non standard HTML/JavaScript so that they can bypass existing approaches as these approaches will parse third party JavaScript twice, at both server and clint side. In this paper, we propose Virtual Browser, a completely virtualized environment within existing browsers for executing untrusted third-party code. We secure complete JavaScript, including all the hard-to-secure functions of JavaScript programs, such as with and eval. Since this approach parses scripts only once, there is no possibility of attacks being executed through browser quirks. We first completely isolate Virtual Browser from the native browser components and then introduce communication by adding data flows carefully examined for security.

引用

页码：654 / 656

页数：3