Discovering Browser Extensions via Web Accessible Resources
Discovering Browser Extensions via Web Accessible Resources
复制标题
通过 Web 可访问资源发现浏览器扩展
DOI：
10.1145/3029806.3029820
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
A. Sabelfeld
中科院分区：
文献类型：
--
作者：
Alexander Sjösten;S. Acker;A. Sabelfeld
浏览器扩展提供了一个强大的平台来丰富浏览体验。与此同时，它们提出了重要的安全问题。从网站的角度来看，一些浏览器扩展是侵入性的，删除了预期的功能并添加了非预期的功能，例如劫持Facebook喜欢的扩展。相反，从扩展的角度来看，有些网站是侵入性的，例如绕过广告拦截器的网站。基于冲突中的安全目标，本文探讨了浏览器扩展发现，通过非行为技术，基于检测扩展的Web可访问资源。我们报告了免费Chrome和Firefox扩展程序的实证研究，能够检测前1,000个免费Chrome扩展程序中的50%以上，包括流行的安全和隐私关键扩展程序，如AdBlock，LastPass，Avast Online Security和Ghostery。我们还对Alexa排名前10万的网站进行了非行为扩展检测的实证研究。我们提出了双重措施，使扩展检测更容易在网站的利益，并使扩展检测更困难的扩展的利益。最后，我们讨论了一个浏览器体系结构，允许用户采取仲裁冲突的安全目标的控制。
Browser extensions provide a powerful platform to enrich browsing experience. At the same time, they raise important security questions. From the point of view of a website, some browser extensions are invasive, removing intended features and adding unintended ones, e.g. extensions that hijack Facebook likes. Conversely, from the point of view of extensions, some websites are invasive, e.g. websites that bypass ad blockers. Motivated by security goals at clash, this paper explores browser extension discovery, through a non-behavioral technique, based on detecting extensions' web accessible resources. We report on an empirical study with free Chrome and Firefox extensions, being able to detect over 50% of the top 1,000 free Chrome extensions, including popular security- and privacy-critical extensions such as AdBlock, LastPass, Avast Online Security, and Ghostery. We also conduct an empirical study of non-behavioral extension detection on the Alexa top 100,000 websites. We present the dual measures of making extension detection easier in the interest of websites and making extension detection more difficult in the interest of extensions. Finally, we discuss a browser architecture that allows a user to take control in arbitrating the conflicting security goals.