Enhancing web browser security against malware extensions

Abstract

In this paper we examine security issues of functionality extension mechanisms supported by web browsers. Extensions (or "plug-ins") in modern web browsers enjoy unrestrained access at all times and thus are attractive vectors for malware. To solidify the claim, we take on the role of malware writers looking to assume control of a user's browser space. We have taken advantage of the lack of security mechanisms for browser extensions and implemented a malware application for the popular Firefox web browser, which we call browserSpy, that requires no special privileges to be installed. browserSpy takes complete control of the user's browser space, can observe all activity performed through the browser and is undetectable. We then adopt the role of defenders to discuss defense strategies against such malware. Our primary contribution is a mechanism that uses code integrity checking techniques to control the extension installation and loading process. We describe two implementations of this mechanism: a drop-in solution that employs JavaScript and a faster, in-browser solution that makes uses of the browser's native cryptography implementation. We also discuss techniques for runtime monitoring of extension behavior to provide a foundation for defending threats posed by installed extensions.

Securing Legacy Firefox Extensions with SENTINEL

“…5. Ter Louw et al [23,24] present a code integrity checking mechanism for extension installation and a policy enforcement framework built into XPConnect and SpiderMonkey. In comparison, our approach is lighter, and we do not modify the core components or architecture of Firefox.…”

Analyzing Information Flow in JavaScript-Based Browser Extensions

“…We evaluated Sabre with four JSEs that had known instances of malicious flows. These included two JSEs that contained exploitable vulnerabilities (Greasemonkey v0.3.3 and Firebug v1.01) and two publicly-available malicious JSEs (FFSniFF [13] and BrowserSpy [41]). …”

“…Ter-Louw et al [41] were the first to address the security of JSEs. However, as discussed in Section 1, their work was based on monitoring XPCOM calls; being coarse-grained, their approach can have both false positives and negatives.…”

“…Examples of such JSEs exist in the wild. They are extremely easy to create and can avoid detection using stealth techniques [11,13,14,15,18,41]. Indeed, we wrote several such JSEs during the course of this project.…”

“…Ter-Louw et al [41] developed a runtime agent to detect malicious JSEs by monitoring XP-COM calls and ensuring that these calls conform to a userdefined security policy. Such a security policy may, for instance, prevent a JSE from accessing the network after it has accessed browsing history.…”