Secure multi-execution of web scripts: Theory and practice

Abstract

Secure Multi-Execution (SME) is a precise and general information flow control mechanism that was claimed to be a good fit for implementing information flow security in browsers. We validate this claim by developing FlowFox, the first fully functional web browser that implements an information flow control mechanism for web scripts based on the technique of secure multi-execution. We provide evidence for the security of FlowFox by proving non-interference for a formal model of the essence of FlowFox, and by showing how it stops real attacks. We provide evidence of usefulness by showing how FlowFox subsumes many ad-hoc script-containment countermeasures developed over the last years. An experimental evaluation on the Alexa top-500 web sites provides evidence for compatibility, and shows that FlowFox is compatible with the current web, even on sites that make intricate use of JavaScript.The performance and memory cost of FlowFox is substantial (a performance cost of around 20% on macro benchmarks for a simple two-level policy), but not prohibitive. Our prototype implementation shows that information flow enforcement based on secure multi-execution can be implemented in full-scale browsers. It can support powerful, yet compatible policies refining the same-origin-policy in a way that is compatible with existing websites.

Monitoring Reactive Systems with Dynamic Channels

“…Hence, the policy can record in its state which channels are open. However, this support for dynamic channels is not present in the formal model of FlowFox [13], and hence no formal guarantees are provided when using this feature.…”

Client Side Web Session Integrity as a Non-interference Property

“…Our prototype implementation is constructed as a modification of the FlowFox browser [12,13]. Crucial for our implementation is the ability to keep track of all sites a user is logged into and to make sure that the labelling of JavaScript API calls can be dependent on this login history.…”

“…Our work is directly based on existing information flow secure browsers that use the mechanism of secure multi-execution [16] for information flow control. The theoretical development is based on Bielova et al [6], whereas the implementation extends the FlowFox browser [12,13]. Alternative dynamic information flow control mechanisms for browser scripts are usually monitors.…”

A Principled Approach to Tracking Information Flow in the Presence of Libraries

“…Bielova and Rezk [4] give a detailed survey and comparison of all kinds of dynamic information flow mechanisms, and we refer the reader to that paper for a detailed discussion. Both lines of work on dynamic information flow control (execution monitoring and multi-execution) have been applied to JavaScript in the browser [13,16], and both have dealt with the problem of interfacing with libraries in a relatively ad-hoc way -essentially by manual programming of models of the library functions, or by treating API calls as I/O operations [14]. Rajani et al [29] propose detailed and rigorous formal models of the DOM and event-handling parts of the browser, and find several potential information leaks.…”

“…Consider, for instance, the following example, that makes use of the standard JavaScript function Array.every which, given a predicate, returns true if every element in the array on which every is called, is in the extension of the predicate. In both JSFlow [17,16] and FlowFox [13,14], accurate modeling of many library functions, such as Array.every, requires hand-written, deep models. This is both labor-intensive and hard to maintain, not scaling to models for a rich set of libraries, as would be needed in a rich execution environment such as a browser or node.js [25,26,24].…”