Analyzing Information Flow in JavaScript-Based Browser Extensions

Abstract

JavaScript-based browser extensions (JSEs) enhance the core functionality of web browsers by improving their look and feel, and are widely available for commodity browsers. To enable a rich set of functionalities, browsers typically execute JSEs with elevated privileges. For example, unlike JavaScript code in a web application, code in a JSE is not constrained by the same-origin policy. Malicious JSEs can misuse these privileges to compromise confidentiality and integrity, e.g., by stealing sensitive information, such as cookies and saved passwords, or executing arbitrary code on the host system. Even if a JSE is not overtly malicious, vulnerabilities in the JSE and the browser may allow a remote attacker to compromise browser security.We present Sabre (Security Architecture for Browser Extensions), a system that uses in-browser information-flow tracking to analyze JSEs. Sabre associates a label with each in-memory JavaScript object in the browser, which determines whether the object contains sensitive information. Sabre propagates labels as objects are modified by the JSE and passed between browser subsystems. Sabre raises an alert if an object containing sensitive information is accessed in an unsafe way, e.g., if a JSE attempts to send the object over the network or write it to a file. We implemented Sabre by modifying the Firefox browser and evaluated it using both malicious JSEs as well as benign ones that contained exploitable vulnerabilities. Our experiments show that Sabre can precisely identify potential information flow violations by JSEs.

May I? - Content Security Policy Endorsement for Browser Extensions

“…In a line of work to secure JavaScript in browser extensions, Dhawan and Ganapathy [8] develop Sabre, a system for tracking the flow of JavaScript objects as they are passed through the browser subsystems. Bandhakavi, et al [2] propose a static analysis tool, VEX, for analyzing Firefox extensions for security vulnerabilities.…”

A Functional View of Imperative Information Flow

“…This research has aimed to develop, then to use, flexible and efficient systems that satisfy non-interference properties. For instance, this research effectively supports promising uses of dynamic information-flow control in Web browsers [5,8,12,21]. This research is often clever and intricate-so we do not attempt to give a complete description here, but we focus on some of the intricacies below.…”

SENTINEL: Securing Legacy Firefox Extensions

“…Djeric and Goel [19] investigate different classes of privilege-escalation vulnerabilities found in Firefox extensions, and propose a tainting-based system to detect them. Similarly, Dhawan and Ganapathy [20] propose SABRE, a framework for dynamically tracking in-browser information flows to detect when a JavaScript extension attempts to compromise browser security. Guha et al [21] propose IBEX, a framework for extension authors to develop extensions with verifiable access control policies, and for curators to detect policy-violating extensions through static analysis.…”