Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks
Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks
复制标题
乳胶手套：保护浏览器扩展免受探测和揭露攻击
DOI：
10.14722/ndss.2019.23309
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
A. Sabelfeld
中科院分区：
文献类型：
--
作者：
Alexander Sjösten;S. Acker;Pablo Picazo;A. Sabelfeld
浏览器扩展为今天的网络用户提供丰富的体验。通过提升权限来部署扩展，扩展被赋予了否决网页的权力。因此，网页经常试图检测已安装的扩展，有时是为了善意地采用它们的行为，但有时是作为侵犯隐私的用户指纹的一部分。研究人员研究了一类允许通过包含公共扩展id的url探测Web可访问资源（war）来检测扩展的攻击。意识到与战争相关的隐私风险，Firefox最近开始随机化浏览器扩展的ID，这促使Chrome团队计划走同样的道路。然而，随机化ID不但不能缓解问题，反而会加剧扩展检测问题，使攻击者能够使用随机化ID作为用户的可靠指纹。我们研究了一类扩展暴露攻击，其中扩展通过在网页上注入其代码来暴露自己。我们演示了如何结合启示和探测可以唯一地识别90%的所有注入内容的扩展，尽管随机方案。我们进行了一系列大规模研究，以估计这两类攻击的可能影响。作为对策，我们提出了一种基于浏览器的机制，可以控制哪些扩展加载到哪些网页上，并提出了一个概念验证实现，可以阻止这两类攻击。
Browser extensions enable rich experience for the users of today's web. Being deployed with elevated privileges, extensions are given the power to overrule web pages. As a result, web pages often seek to detect the installed extensions, sometimes for benign adoption of their behavior but sometimes as part of privacy-violating user fingerprinting. Researchers have studied a class of attacks that allow detecting extensions by probing for Web Accessible Resources (WARs) via URLs that include public extension IDs. Realizing privacy risks associated with WARs, Firefox has recently moved to randomize a browser extension's ID, prompting the Chrome team to plan for following the same path. However, rather than mitigating the issue, the randomized IDs can in fact exacerbate the extension detection problem, enabling attackers to use a randomized ID as a reliable fingerprint of a user. We study a class of extension revelation attacks, where extensions reveal themselves by injecting their code on web pages. We demonstrate how a combination of revelation and probing can uniquely identify 90% out of all extensions injecting content, in spite of a randomization scheme. We perform a series of large-scale studies to estimate possible implications of both classes of attacks. As a countermeasure, we propose a browser-based mechanism that enables control over which extensions are loaded on which web pages and present a proof of concept implementation which blocks both classes of attacks.