Assessing the threat of web worker distributed attacks
Assessing the threat of web worker distributed attacks
复制标题
评估网络工作者分布式攻击的威胁
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Yu Sun
中科院分区：
文献类型：
--
作者：
Yao Pan;Jules White;Yu Sun
在本文中，我们确定和评估的潜力，通过Web浏览器使用HTML5 Web Workers API发起的新的分布式攻击。Web Workers攻击依赖于Web Workers的新多线程功能，该功能允许恶意JavaScript代码在网页后台运行，而不会影响前台JavaScript性能或用户体验。这些后台计算任务可用于发起应用层DDoS攻击或将计算密集型攻击任务（如密码破解）卸载到访问受损网站的用户的浏览器。这些攻击不会直接伤害受感染的用户，但为攻击者提供了一条控制大型计算资源池的潜在途径，类似于僵尸网络。我们评估了使用在线广告服务来访问此类计算池的可行性，并定量评估了这些攻击的经济性，并指出了与云计算或租用僵尸网络相比，影响通过Web Workers发动攻击的成本效益的关键因素。
In this paper, we identify and evaluate the potential of new distributed attacks launched through web browsers using the HTML5 Web Workers API. Web worker attacks rely on the new multi-threading capabilities of Web Workers, which can allow malicious JavaScript code to run in the background of a web page without impacting foreground JavaScript performance or user experience. These background computing tasks can be used to launch application-layer DDoS attacks or offload computationally intensive attack tasks, such as password cracking, to the browsers of users visiting a compromised website. These attacks do not harm the compromised users directly but offer a potential path for attackers to gain control of large pools of computing resources, similar to botnets. We evaluate the feasibility of using online advertisement services to gain access to such computing pool and quantitatively evaluate the economics of these attacks and point out the key factors affecting the cost effectiveness of launching attacks through Web Workers in comparison with cloud computing or rented botnets.