MalloryWorker: Stealthy Computation and Covert Channels Using Web Workers

Rushanan, Michael; Russell, David; Rubin, Aviel D.

doi:10.1007/978-3-319-46598-2_14

Cited by 9 publications

(11 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In most of the Android cases documented by researchers, information is leaked from one app to another through a covert channel [17,18]. Although Rushanan et al in [19] achieve a goal similar to ours, their study concerns only the desktop environment. Their approach consists in exploiting the Web Workers API in order to increase the CPU and memory utilization.…”

Section: Isolation Of Apps In Androidmentioning

confidence: 77%

Session Fingerprinting in Android via Web-to-App Intercommunication

Alepis

Patsakis

2018

Security and Communication Networks

View full text Add to dashboard Cite

The extensive adoption of mobile devices in our everyday lives, apart from facilitating us through their various enhanced capabilities, has also raised serious privacy concerns. While mobile devices are equipped with numerous sensors which offer context-awareness to their installed apps, they can also be exploited to reveal sensitive information when correlated with other data or sources. Companies have introduced a plethora of privacy invasive methods to harvest users’ personal data for profiling and monetizing purposes. Nonetheless, up till now, these methods were constrained by the environment they operate, e.g., browser versus mobile app, and since only a handful of businesses have actual access to both of these environments, the conceivable risks could be calculated and the involved enterprises could be somehow monitored and regulated. This work introduces some novel user deanonymization approaches for device and user fingerprinting in Android. Having Android AOSP as our baseline, we prove that web pages, by using several inherent mechanisms, can cooperate with installed mobile apps to identify which sessions operate in specific devices and consequently further expose users’ privacy.

show abstract

Section: Isolation Of Apps In Androidmentioning

confidence: 77%

Session Fingerprinting in Android via Web-to-App Intercommunication

Alepis

Patsakis

2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Furthermore, the evaluation done by Rushanan [34] was performed on an old i5 processor and therefore the results are obsolete. It was essential to get more up-to-date results on how an MD5 hasher performs on a browser using a modern CPU, and to compare these results as well.…”

Section: Discussionmentioning

confidence: 99%

“…The feasibility of performing stealthy calculations using HTML5 Web Workers is presented by Rushanan [34]. Web Workers are JavaScripts that run in the background, allowing web applications to spawn background workers in parallel to the main thread.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

The Risks of WebGL: Analysis, Evaluation and Detection

Belkin

Gelernter

Cidon

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

WebGL is a browser feature that enables JavaScript-based control of the graphics processing unit (GPU) to render interactive 3D and 2D graphics, without the use of plug-ins. Exploiting WebGL for attacks will affect billions of users since browsers serve as the main interaction mechanism with the world wide web. This paper explores the potential threats derived from the recent move by browsers from WebGL 1.0 to the more powerful WebGL 2.0. We focus on two possible abuses of this feature: distributed password cracking and distributed cryptocurrency mining. Our evaluation of the attacks also includes the practical aspects of successful attacks, such as stealthiness and user-experience. Considering the danger of WebGL abuse, as observed in the experiments, we designed and evaluated a proactive defense. We implemented a Chrome extension that proved itself effective in detecting and blocking WebGL. We demonstrate in our experiments the major improvements of WebGL 2.0 over WebGL 1.0 both in performance and in convenience. Furthermore, our results show that it is possible to use WebGL 2.0 in distributed attacks under real-world conditions. Although WebGL 2.0 shows similar hash rates as CPU-based techniques, WebGL 2.0 proved to be significantly harder to detect and has a lesser effect on user experience.

show abstract

“…Kuppan [51] demonstrate this ability of using web workers to perform DDoS attacks. Rushanan et al in [79], also use web workers to perform stealthy computations on the user side and launch not only attacks like DoS and resource depletion but also covert channel using CPU and memory throttling. Pellegrino et al [74] also present different techniques to orchestrate web-based DoS attacks, by utilizing web workers among other HTML5 features, and provide an economic analysis and costs of browser-based botnets.…”

Section: Related Workmentioning

confidence: 99%

Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation

Papadopoulos

Ilia

Polychronakis

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The proliferation of web applications has essentially transformed modern browsers into small but powerful operating systems. Upon visiting a website, user devices run implicitly trusted script code, the execution of which is confined within the browser to prevent any interference with the user's system. Recent JavaScript APIs, however, provide advanced capabilities that not only enable feature-rich web applications, but also allow attackers to perform malicious operations despite the confined nature of JavaScript code execution.In this paper, we demonstrate the powerful capabilities that modern browser APIs provide to attackers by presenting MarioNet: a framework that allows a remote malicious entity to control a visitor's browser and abuse its resources for unwanted computation or harmful operations, such as cryptocurrency mining, password-cracking, and DDoS. MarioNet relies solely on already available HTML5 APIs, without requiring the installation of any additional software. In contrast to previous browserbased botnets, the persistence and stealthiness characteristics of MarioNet allow the malicious computations to continue in the background of the browser even after the user closes the window or tab of the initial malicious website. We present the design, implementation, and evaluation of a prototype system, MarioNet, that is compatible with all major browsers, and discuss potential defense strategies to counter the threat of such persistent inbrowser attacks. Our main goal is to raise awareness regarding this new class of attacks, and inform the design of future browser APIs so that they provide a more secure client-side environment for web applications.

show abstract

MalloryWorker: Stealthy Computation and Covert Channels Using Web Workers

Cited by 9 publications

References 4 publications

Session Fingerprinting in Android via Web-to-App Intercommunication

Session Fingerprinting in Android via Web-to-App Intercommunication

The Risks of WebGL: Analysis, Evaluation and Detection

Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation

Contact Info

Product

Resources

About