Time Does Not Heal All Wounds: A Longitudinal Analysis of Security-Mechanism Support in Mobile Browsers
Time Does Not Heal All Wounds: A Longitudinal Analysis of Security-Mechanism Support in Mobile Browsers
复制标题
DOI：
10.14722/ndss.2019.23149
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Meng Luo;Pierre Laperdrix;N. Honarmand;Nick Nikiforakis
中科院分区：
文献类型：
--
作者：
Meng Luo;Pierre Laperdrix;N. Honarmand;Nick Nikiforakis
-最近的市场份额统计数据显示，移动设备的流量已经超过了传统的台式电脑。用户在智能手机和平板电脑上花费的时间越来越多，而网络仍然是向用户提供新应用程序的首选平台。在这种环境下，web应用程序有必要利用所有可用的工具来保护移动用户免受流行的web应用程序攻击。在本文中，我们首次研究了流行的web应用程序安全机制（如内容安全策略、HTTP严格传输安全性和推荐策略）在移动浏览器上的支持。我们设计了395个独立测试，涵盖8种不同的安全机制，并利用它们来评估Android上20个最流行的浏览器系列对安全机制的支持。此外，通过收集和测试过去七年的浏览器版本，我们根据上述测试评估了总共351个独特的浏览器版本，收集了超过138K的测试结果。通过分析这些结果，我们发现，尽管随着时间的推移，移动浏览器通常支持更多的安全机制，但并非所有浏览器都以同样的方式发展。我们发现流行的浏览器，有数百万的下载，不支持大多数测试机制，并确定设计选择，其次是大多数浏览器，这使得数百个流行的网站开放点击劫持攻击。此外，我们发现在流行网站开始使用安全机制和移动浏览器执行安全机制之间存在多年的漏洞窗口。我们的发现强调了对移动web浏览器进行持续安全测试的必要性，以及能够适应每个浏览器可以保证的安全级别的服务器端框架。
—Recent market share statistics show that mobile device traffic has overtaken that of traditional desktop computers. Users spend an increasing amount of time on their smartphones and tablets, while the web continues to be the platform of choice for delivering new applications to users. In this environment, it is necessary for web applications to utilize all the tools at their disposal to protect mobile users against popular web application attacks. In this paper, we perform the first study of the support of popular web-application security mechanisms (such as the Content-Security Policy, HTTP Strict Transport Security, and Referrer Policy) across mobile browsers. We design 395 individual tests covering 8 different security mechanisms, and utilize them to evaluate the security-mechanism support in the 20 most popular browser families on Android. Moreover, by collecting and testing browser versions from the last seven years, we evaluate a total of 351 unique browser versions against the aforementioned tests, collecting more than 138K test results. By analyzing these results, we find that, although mobile browsers generally support more security mechanisms over time, not all browsers evolve in the same way. We discover popular browsers, with millions of downloads, which do not support the majority of the tested mechanisms, and identify design choices, followed by the majority of browsers, which leave hundreds of popular websites open to clickjacking attacks. Moreover, we discover the presence of multi-year vulnerability windows between the time when popular websites start utilizing a security mechanism and when mobile browsers enforce it. Our findings highlight the need for continuous security testing of mobile web browsers, as well as server-side frameworks which can adapt to the level of security that each browser can guarantee.