Portable and Efficient Run-time Monitoring of JavaScript Applications Using Virtual Machine Layering

Lavoie, Erick; Dufour, Bruno; Feeley, Marc

doi:10.1007/978-3-662-44202-9_22

Cited by 7 publications

(6 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To ensure that our own function is called instead of the original function, without modifying the browser, we facilitate a technique known as virtual machine layering [19]. Although this technique was originally developed for low-overhead runtime monitoring, we show that in combination with JavaScript closures, it can also be applied as a security mechanism.…”

Section: A Virtual Machine Layeringmentioning

confidence: 99%

“…Virtual machine layering was originally developed for low-overhead run-time monitoring of functions [19]. We use it to guarantee that a policy is always applied to a function (Challenge C1).…”

Section: Implementation Of Chrome Zeromentioning

confidence: 99%

“…C3 Restrictions must not have a significant impact on compatibility and user experience. To overcome challenge C1, we utilize advanced language features such as virtual machine layering [19] for security. In contrast to previous approaches [56], virtual machine layering allows redefining any function of the JavaScript virtual machine at runtime.…”

mentioning

confidence: 99%

See 2 more Smart Citations

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Schwarz

Lipp

Gruss

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and sidechannel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks. I. INTRODUCTIONOver the past 20 years, JavaScript has evolved to the predominant language on the web. Of the 10 million most popular websites, 94.7 % use JavaScript [54]. Dynamic content relies heavily on JavaScript, and thus, most pages use JavaScript to improve the user experience, using, e.g., AJAX and dynamic page manipulation. Especially for platform-independent HTML5 applications, JavaScript is a vital component. Microarchitectural attacks can also be implemented in JavaScript, exploiting properties inherent to the design of the microarchitecture, such as timing differences in memory accesses. Although JavaScript code runs in a sandbox, Oren et al.[33] demonstrated that it is possible to mount cache attacks in JavaScript. Since their work, a series of microarchitectural attacks have been mounted from websites, such as page deduplication attacks [14], Rowhammer attacks [15], ASLR bypasses [13], and DRAM addressing attacks [40].As a response to these attacks, some-but not all-of the APIs have been restricted by reducing the resolution (e.g., High Precision Time API) [2], [6], [9] or completely removing them (e.g., DeviceOrientation Event Specification) [51]. However, these countermeasures are incomplete as they do not cover all s...

show abstract

Section: A Virtual Machine Layeringmentioning

confidence: 99%

Section: Implementation Of Chrome Zeromentioning

confidence: 99%

See 1 more Smart Citation

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Schwarz

Lipp

Gruss

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…In addition, although the id is added as a non‐enumerable property to make it invisible during execution, it can be still visible. For example, the Object.getOwnPropertyNames function returns all property names irrespective of their iterable nature . To prevent such a problem, if the application code happens to use the Object.getOwnPropertyNames function, this function could be wrapped to exclude reporting any property with the specific name __objectID__.…”

Section: Discussion and Limitationsmentioning

confidence: 99%

LeakSpot: detection and diagnosis of memory leaks in JavaScript applications

Rudafshani

Ward

2016

Softw. Pract. Exper.

View full text Add to dashboard Cite

Summary The migration of application logic to the client side of modern web applications and the use of JavaScript as the main language for client‐side development have made memory leaks in JavaScript an issue for web applications. Client‐side web applications communicate with the server asynchronously, remaining on the same web page during their lifetime. Thus, even minor memory leaks can eventually lead to excessive memory usage, negatively affecting user‐perceived response time and possibly causing page crashes. To detect memory leaks and guide developers in fixing the leaks quickly and easily, this paper introduces LeakSpot, a tool that creates a run‐time heap model by modifying the application code in a browser‐agnostic way to record object allocations, accesses, and references created to objects. LeakSpot reports those allocation sites causing the leaks instead of all the leaky allocation sites. It also identifies the locations in the code where leaked objects are accumulated, for example, the locations where a reference from a data structure is created but forgotten to be removed by the developer. To facilitate debugging and fixing the leaks, for every leaked object, LeakSpot reports all the locations in the code that create a reference to the object. To confirm usefulness and efficacy of LeakSpot experimentally, we have used LeakSpot to find and fix four memory leaks in a JavaScript benchmark suite and in open‐source web applications. LeakSpot is also shown to be effective in pointing out the potential causes of three leaks in large and popular web applications. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

“…2) They cannot perform just-in-time compilation, which tends to slow down execution of the JavaScript programs. A notable meta-circular interpreter that has been used for dynamic analysis is Photon [Lavoie et al 2014].…”

Section: Dynamic Analysesmentioning

confidence: 99%

A Survey of Dynamic Analysis and Test Generation for JavaScript

et al. 2017

View full text Add to dashboard Cite

JavaScript has become one of the most prevalent programming languages. Unfortunately, some of the unique properties that contribute to this popularity also make JavaScript programs prone to errors and difficult for program analyses to reason about. These properties include the highly dynamic nature of the language, a set of unusual language features, a lack of encapsulation mechanisms, and the "no crash" philosophy. This paper surveys dynamic program analysis and test generation techniques for JavaScript targeted at improving the correctness, reliability, performance, security, and privacy of JavaScript-based software.CCS Concepts: r General and reference → Surveys and overviews; r Software and its engineering → Software notations and tools; r Security and privacy → Web application security;

show abstract

Portable and Efficient Run-time Monitoring of JavaScript Applications Using Virtual Machine Layering

Cited by 7 publications

References 7 publications

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

LeakSpot: detection and diagnosis of memory leaks in JavaScript applications

A Survey of Dynamic Analysis and Test Generation for JavaScript

Contact Info

Product

Resources

About