Defeating script injection attacks with browser-enforced embedded policies

Jim, Trevor; Swamy, Nikhil; Hicks, Michael

doi:10.1145/1242572.1242654

Cited by 201 publications

(172 citation statements)

References 17 publications

Supporting

Mentioning

172

Contrasting

Order By: Relevance

“…XSS Web Application attack mechanisms can be detected indirectly by comparing posted URL to black-listed sites [36], by identifying typical XSS coding patterns [37]. The detection and prevention of XSS attack are difficult because of incomplete implementations, inherent limitations, the complexity of development frameworks and the requirement for run-time compatibility [38].…”

Section: Fig 1 the Difference Between False Negative And False Posimentioning

confidence: 99%

Human Perception of the Measurement of a Network Attack Taxonomy in Near Real-Time

Heerden

Malan

Mouton

et al. 2014

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Abstract. This paper investigates how the measurement of a network attack taxonomy can be related to human perception. Network attacks do not have a time limitation, but the earlier its detected, the more damage can be prevented and the more preventative actions can be taken. This paper evaluate how elements of network attacks can be measured in near real-time(60 seconds). The taxonomy we use was developed by van Heerden et al (2012) with over 100 classes. These classes present the attack and defenders point of view. The degree to which each class can be quantified or measured is determined by investigating the accuracy of various assessment methods. We classify each class as either defined, high, low or not quantifiable. For example, it may not be possible to determine the instigator of an attack (Aggressor), but only that the attack has been launched by a Hacker (Actor). Some classes can only be quantified with a low confidence or not at all in a sort (near real-time) time. The IP address of an attack can easily be faked thus reducing the confidence in the information obtained from it, and thus determining the origin of an attack with a low confidence. This determination itself is subjective. All the evaluations of the classes in this paper is subjective, but due to the very basic grouping (High, Low or Not Quantifiable) a subjective value can be used. The complexity of the taxonomy can be significantly reduced if classes with only a high perceptive accuracy is used.

show abstract

Section: Fig 1 the Difference Between False Negative And False Posimentioning

confidence: 99%

Human Perception of the Measurement of a Network Attack Taxonomy in Near Real-Time

Heerden

Malan

Mouton

et al. 2014

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

show abstract

“…As for JavaScript several techniques have been proposed (Nentwich et al, 2007;Yu et al, 2007;Jim et al, 2007;Dhawan and Ganapathy, 2009;Chudnov and Naumann, 2010;Jang et al, 2010) such as solutions based on client-side or server-side to prevent history sniffing, disable unknown scripts, signed scripts, program instrumentation and dynamic taint propagation and checking. Some of these solutions can be implemented in proxies and other requires the modification of Web browser source code.…”

Section: Privacy Solutions For Application Layermentioning

confidence: 99%

A survey on solutions and main free tools for privacy enhancing Web communications

Ruiz‐Martínez¹

2012

Journal of Network and Computer Applications

View full text Add to dashboard Cite

Concern for privacy when users are surfing on the Web has increased recently. Nowadays, many users are aware that when they are accessing Web sites, these Web sites can track them and create profiles on the elements they access, the advertisements they see, the different links they visit, from which Web sites they come from and to which sites they exit, and so on. In order to maintain user privacy, several techniques, methods and solutions have appeared. In this paper we present an analysis of both these solutions and the main tools that are freely distributed or can be used freely and that implement some of these techniques and methods to preserve privacy when users and surfing on the Internet. This work, unlike previous reviews, shows in a comprehensive way, all the different risks when a user navigates on the Web, the different solutions proposed that finally have being implemented and being used to achieve Web privacy goal. Thus, users can decide which tools to use when they want navigate privately and what kind of risks they are assuming.

show abstract

“…Alternative proposals to the analysis and filtering of web content on either serveror client-based proxies, such as [18,26,25], try to eliminate the need for intermediate elements by proposing strategies for the enforcement of the runtime context of the end-point, i.e., the web browser.…”

Section: Runtime Enforcement Of Web Browsersmentioning

confidence: 99%

Prevention of Cross-Site Scripting Attacks on Current Web Applications

García-Alfaro

Navarro‐Arribas

On the Move to Meaningful Internet Systems 2007: CoopIS, DOA, ODBASE, GADA, and IS

View full text Add to dashboard Cite

Abstract. Security is becoming one of the major concerns for web applications and other Internet based services, which are becoming pervasive in all kinds of business models and organizations. Web applications must therefore include, in addition to the expected value offered to their users, reliable mechanisms to ensure their security. In this paper, we focus on the specific problem of preventing cross-site scripting attacks against web applications. We present a study of this kind of attacks, and survey current approaches for their prevention. The advantages and limitations of each proposal are discussed, and an alternative solution is introduced. Our proposition is based on the use of X.509 certificates, and XACML for the expression of authorization policies. By using our solution, developers and/or administrators of a given web application can specifically express its security requirements from the server side, and require the proper enforcement of such requirements on a compliant client. This strategy is seamlessly integrated in generic web applications by relaying in the SSL and secure redirect calls.

show abstract

Defeating script injection attacks with browser-enforced embedded policies

Cited by 201 publications

References 17 publications

Human Perception of the Measurement of a Network Attack Taxonomy in Near Real-Time

Human Perception of the Measurement of a Network Attack Taxonomy in Near Real-Time

A survey on solutions and main free tools for privacy enhancing Web communications

Prevention of Cross-Site Scripting Attacks on Current Web Applications

Contact Info

Product

Resources

About