Enabling Reconstruction of Attacks on Users via Efficient Browsing Snapshots

Abstract

In this paper, we present ChromePic, a web browser equipped with a novel forensic engine that aims to greatly enhance the browser's logging capabilities. ChromePic's main goal is to enable a fine-grained post-mortem reconstruction and trace-back of web attacks without incurring the high overhead of record-andreplay systems. In particular, we aim to enable the reconstruction of attacks that target users and have a significant visual component, such as social engineering and phishing attacks. To this end, ChromePic records a detailed snapshot of the state of a web page, including a screenshot of how the page is rendered and a "deep" DOM snapshot, at every significant interaction between the user and the page. If an attack is later suspected, these finegrained logs can be used to reconstruct the attack and trace back the sequence of steps the user followed to reach the attack page. We develop ChromePic by implementing several careful modifications and optimizations to the Chromium code base, to minimize overhead and make always-on logging practical. We then demonstrate that ChromePic can successfully capture and aid the reconstruction of attacks on users. Our evaluation includes the analysis of an in-the-wild social engineering download attack on Android, a phishing attack, and two different clickjacking attacks, as well as a user study aimed at accurately measuring the overhead introduced by our forensic engine. The experimental results show that browsing snapshots can be logged very efficiently, making the logging events practically unnoticeable to users. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Discovering Correlations: A Formal Definition of Causal Dependency Among Heterogeneous Events

“…These principles can also apply at the application level. In [45], the authors instrument the Chrome web browser to enable the logging and replay of the user action contexts, i.e., the document object model that contains web page objects and Javascript source code. By enabling the finer-grained logging of action contexts, these methodologies also allow the approximation of the contextual action causal dependency model.…”

Efficient and Transparent Method for Large-Scale TLS Traffic Analysis of Browsers and Analogous Programs

“…web browser with the forensic engine named ChromePic [38], which could record and reconstruct the process of common web attacks based on Chromium. Jayasinghe et al proposed a novel dynamic approach to detect drive-by download attacks [1], and it can monitor the bytecode generated by a browser in real time with low performance overhead.…”

JSgraph: Enabling Reconstruction of Web Attacks via Efficient Tracking of Live In-Browser JavaScript Executions

“…Then, an HTTP-based redirection takes the browser to a page on pressupdateforsafesoft[.]download. As we will see later, this page renders as shown in the screenshots of Figures 1c-1e (notice that while JSgraph does not log visual screenshots, this functionality could be easily implemented very efficiently with the approach used by ChromePic [43]). As the user clicks on the download button (see Figure 1d), this corresponds to clicking on an HTML anchor that navigates the browser to the pressbuttonforupdate[.…”

“…One possible way would be to record, and later statically analyze, all the HTML and JavaScript content loaded by the browser during a time window that includes the attack. This could be done by recording all network traffic traces, or by using a lightweight system such as ChromePic [43]. However, understanding how the browser loaded, parsed, interpreted, and rendered the web content from network traces is notoriously hard [38].…”