An empirical study of privacy-violating information flows in JavaScript web applications

Abstract

The dynamic nature of JavaScript web applications has given rise to the possibility of privacy violating information flows. We present an empirical study of the prevalence of such flows on a large number of popular websites. We have (1) designed an expressive, fine-grained information flow policy language that allows us to specify and detect different kinds of privacy-violating flows in JavaScript code, (2) implemented a new rewriting-based JavaScript information flow engine within the Chrome browser, and (3) used the enhanced browser to conduct a large-scale empirical study over the Alexa global top 50,000 websites of four privacyviolating flows: cookie stealing, location hijacking, history sniffing, and behavior tracking. Our survey shows that several popular sites, including Alexa global top-100 sites, use privacy-violating flows to exfiltrate information about users' browsing behavior. Our findings show that steps must be taken to mitigate the privacy threat from covert flows in browsers.

Secure multi-execution of web scripts: Theory and practice

“…Scripts can leak session identifiers [44], inject requests into an ongoing session [9], sniff the user's browsing history, or track the user's behavior on a web site [29]. Such malicious scripts can enter a web page because of a cross-site scripting vulnerability [31], or because the page integrates third party scripts such as advertisements, or gadgets.…”

“…Several researchers [14,40] have proposed information flow control as a general and powerful security enforcement mechanism that can address many of these attacks, and hence reduce the need for ad-hoc or The adaptation of the Style API is an example of an ad-hoc countermeasure specifically developed to mitigate the history sniffing threat [8], but most of the privacy leaks described by Jang et al [29] are not yet countered in modern browsers.…”

Architectures for Inlining Security Monitors in Web Applications

“…However, once third-party code is included in a web page, it is executed with the same privileges as the code that uses the libraries. This gives rise to a number of attack possibilities that include location hijacking, behavioral tracking, leaking cookies, and sniffing browsing history [21]. Security policy stakeholders An additional complication is that the different stakeholders have different interests in the security policies to be enforced in web applications.…”

“…Our focus on information flow is justified by the nature of the JavaScript attacks from the empirical studies [21,32] that demonstrate the current security practices fail to prevent such attacks as location hijacking, behavioral tracking, leaking cookies, and sniffing browsing history. Jang et al [21] report on both explicit and implicit flows exploited in the empirical studies.…”

“…Jang et al [21] report on both explicit and implicit flows exploited in the empirical studies. Further, inlining by security-enhanced interpreting is a particularly suitable choice for tracking information flow in JavaScript, because alternative approaches to inlining suffer from scalability problems, as discussed in Section 5.…”