TC: Small: Keeping Jack in the Box: Confining the Role of Untrusted Inputs in Web Scenarios

点击翻译按钮获取中文摘要

A significant number of attacks on Web browsers and Web applicationsare successful through the use of malicious inputs.For instance, attacks on web browser extensions target browsers byexploiting vulnerable extensions (add-ons) by supplying malicious input. Malicious inputs exercise unintended behaviors leading to attacks thatcompromise confidentiality, integrity andavailability of web-based systems. This project systematicallyexamines the role that user inputs play in web browsers and applications, and develops techniques to prevent these attacks by confining their influence. The challenge is to develop sound and precise automated analysis mechanisms for web based platforms such as JavaScript. Research from the areas of static and dynamic analysis, information flow tracking and learning program behaviorswill be used to develop robust, efficient and highly precise techniques.Papers from the project will be distributed in popular onlineresources for Web security for the widest possible dissemination andfurther enhancement. Furthermore, the PIs will transition results fromthis research to Web development and standards communities. The results of this project will be integrated into the new andexisting courses in the undergraduate and graduate curricula at theUniversity of Illinois campuses at Chicago and Urbana Champaign. These courses will train a growing workforce of software engineerswho will be more security-aware and apply these principles forlaying a platform for a more secure Web. This project will also directlycontribute to the research training of three Ph.D. studentssupervised by the PIs. This project will also support the involvementof the PIs in outreach activities aimed at K-12 teacher training andminority groups, and contributions by designing programs that createawareness and interest in computer science.