wraudit: A Tool to Transparently Monitor Web Resources’ Integrity

Salvador, David; Cucurull, Jordi; Julià, Pau

doi:10.1007/978-3-030-05918-7_21

Cited by 3 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although SRI is meant primarily for securing the integrity of external subresources, its use for local subresources still makes sense (i.e., if the subresource is hosted on another server through a reverse proxy or if only some les on the server could be corrupted by the adversary) and should not be interpreted as erroneous or meaningless (Salvador et al [37] discuss this point in detail). It could be the result of build tools that automatically compute and insert integrity attributes even for local subresources.…”

Section: Sri Usagementioning

confidence: 99%

“…Another, less related, body of works studies the limitations of integrity veri cation mechanisms (including SRI) and proposes solutions and alternatives. Salvador et al [37] highlight the risks when the server that hosts the webpages is compromised. They address this issue by developing wraudit, a tool that transparently monitors the integrity of the published code based on a trusted and user-input baseline.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources

Chapuis¹,

Omolola²,

Cherubini³

et al. 2020

Proceedings of the Web Conference 2020

View full text Add to dashboard Cite

Web developers can (and do) include subresources such as scripts, stylesheets and images in their webpages. Such subresources might be stored on content delivery networks (CDNs). This practice creates security and privacy risks, should a subresource be corrupted. The subresource integrity (SRI) recommendation, released in mid-2016 by the W3C, enables developers to include digests in their webpages in order for web browsers to verify the integrity of subresources before loading them. In this paper, we conduct the rst large-scale longitudinal study of the use of SRI on the Web by analyzing massive crawls (≈3B URLs) of the Web over the last 3.5 years. Our results show that the adoption of SRI is modest (≈3.40%), but grows at an increasing rate and is highly in uenced by the practices of popular library developers (e.g., Bootstrap) and CDN operators (e.g., jsDelivr). We complement our analysis about SRI with a survey of web developers (=227): It shows that a substantial proportion of developers know SRI and understand its basic functioning, but most of them ignore important aspects of the recommendation. The results of the survey also show that the integration of SRI by developers is mostly manual-hence not scalable and error prone. This calls for a better integration of SRI in build tools. CCS CONCEPTS • Security and privacy → Web protocol security; Hash functions and message authentication codes.

show abstract

Section: Sri Usagementioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources

Chapuis¹,

Omolola²,

Cherubini³

et al. 2020

Proceedings of the Web Conference 2020

View full text Add to dashboard Cite

show abstract

“…Websites offer users a variety of services [7], and the stability and reliability of these websites largely depend on their reliance on third-party services, including Content Delivery Network (CDN), Domain Name System (DNS), and Certi cate Authority (CA) services [8,9,10,11]. Additionally, the adoption of IPv6 [12,13,14,15], the application of IPv6 in domain name resolution servers [16], Internet Service Providers (ISPs) [17,18], and the third-party components and resources on which web services rely [19,20,21,22] also impact their overall performance and availability.…”

Section: Related Workmentioning

confidence: 99%

SilkSecured: A Comprehensive Analysis of Security and Dependencies in China's Governmental Web Systems

Zuo,

Cheng,

et al. 2024

Preprint

View full text Add to dashboard Cite

The study "SilkSecured" delves into the practice of governmental web systems in China. It scrutinizes the security and dependency challenges besieging China's governmental web infrastructure, with an intent to unearth pivotal concerns and proffer enhancements. The inquiry reveals substantial vulnerabilities and dependencies that could impede the digital efficacy and safety of governmental web systems. To counter these identified frailties, "SilkSecured" presents a suite of strategic recommendations tailored to bolster the digital fortitude of China's governmental web infrastructure. It underscores the critical need for robust domain name resolution services to assure secure and reliable access to government websites. The study accentuates the necessity for stringent vetting and regular updates of third-party libraries, aiming to avert potential security threats. Furthermore, it advocates for an optimized deployment of web systems by advocating for a diversified distribution of network nodes, which could substantially augment system resilience and performance. Through this comprehensive analysis, "SilkSecured" aspires to serve as a beacon for governmental departments, championing the ongoing enhancement of security protocols within China's governmental web domains. This initiative is envisioned to fortify the digital infrastructure against the spectrum of evolving cyber threats, thus safeguarding the digital governance ecosystem in China. The recommendations provided aim to underpin the robustness and reliability of governmental web systems, ensuring their integrity in the digital era.

show abstract