Collaborative Research: SaTC: CORE: Medium: App-driven Web Browsing: Novel Risks, Vulnerabilities, and Defenses

现代Web生态系统由大量非浏览器应用程序组成，这些应用程序虽然具有相同的处理和呈现Web内容的能力，但使用不同的技术开发并显示不同的功能。在这种新的浏览模式中，应用程序开发人员负责配置和实现已在传统浏览器中标准化的安全功能。偏离众所周知的默认设置的选项有可能使他们的软件面临错误配置，最终使用户面临严重的安全风险。该项目专注于对允许Web浏览的现代非浏览器应用程序的特性、功能和功能进行全面和深入的分析。该项目的新颖贡献包括设计和开发各种技术和系统，以揭示驱动这些应用程序的不同技术中的固有安全缺陷。该项目的更广泛的意义和重要性在于这些网络和移动应用程序在更大的网络生态系统中的关键定位，以及更强大的漏洞检测和预防能力的必要性。该项目探索、测量并解决用于开发支持Web浏览的应用程序的技术所固有的安全缺陷。这需要实施新的静态和动态代码和应用程序分析技术，以检测安全问题，从而实现从不正确的来源隔离强制执行到远程代码注入和执行的各种攻击。此外，该项目还包括开发观察站，以了解这些浏览应用程序是否随着时间的推移变得更加安全，并以数据驱动的方式识别新的漏洞。这项研究的结果加强了研究社区对应用程序驱动的浏览风险的理解，并提供了改善应用程序生态系统安全卫生的解决方案，同时通过学术出版物、课程整合、行业会议和媒体文章广泛传播。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

The modern web ecosystem is comprised of a multitude of non-browser applications that, while having the same ability to process and render web content, are developed with different technologies and exhibit different capabilities. In this new browsing paradigm, app developers are responsible for configuring and implementing security features that are already standardized in traditional browsers. The option to deviate from well-known defaults has the potential of opening their software to misconfigurations and ultimately exposing users to significant security risks. This project focuses on providing a holistic and in-depth analysis of the features, functionality, and capabilities of modern non-browser apps that allow web browsing. The project’s novel contributions include the design and development of diverse techniques and systems for uncovering the inherent security flaws in the different technologies that power these apps. The project's broader significance and importance lie in the critical positioning of these web and mobile apps within the greater web ecosystem, and the necessity of more robust flaw detection and prevention capabilities. This project explores, measures, and addresses the security flaws that are inherent to the technologies used for developing apps that enable web browsing. This requires implementing novel static and dynamic code and app analysis techniques for detecting security issues that enable a wide range of attacks, from incorrect origin-isolation enforcement to remote code injection and execution. Moreover, the project includes the development of observatories to understand whether these browsing apps are becoming more secure over time and identify new vulnerabilities, in a data-driven fashion. The outcomes of this research strengthen the research community's understanding of the risks of app-driven browsing and provide solutions that improve the security hygiene of the app ecosystem, while being widely disseminated through academic publications, curriculum integration, industry conferences, and media articles.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.