Fine-Grained Detection of Privilege Escalation Attacks on Browser Extensions

Abstract

Even though their architecture relies on robust security principles, it is well-known that poor programming practices may expose browser extensions to serious security flaws, leading to privilege escalations by untrusted web pages or compromised extension components. We propose a formal security analysis of browser extensions in terms of a finegrained characterization of the privileges that an active opponent may escalate through the message passing interface and we discuss to which extent current programming practices take this threat into account. Our theory builds on a formal language that embodies the essential features of JavaScript, together with few additional constructs dealing with the security aspects specific to the browser extension architecture. We then present a flow logic specification estimating the safety of browser extensions modelled in our language against the threats of privilege escalation and we prove its soundness. Finally, we show the feasibility of our approach by means of Chen, a prototype static analyser for Google Chrome extensions based on our flow logic specification.

Formal methods for web security

“…A core of λ-JS was also the language chosen by Calzavara et al [23] to design a sound static analysis to detect privilege escalation attacks on browser extensions, where malicious or compromised extension components abuse the message passing interface available to them to unduly gain access to securitysensitive functionalities. The static analysis was implemented in a prototype analyser for Google Chrome extensions, called CHEN.…”

EmPoWeb: Empowering Web Applications with Browser Extensions

“…Due to their privileged position in browsers, it is well understood that extensions pose serious security and privacy threats to user data [7], [8], [9], [10], [11], [12], [13]. Therefore, in order to limit extensions capabilities, a mandatory permission system requires that extensions explicitly declare the set of APIs they effectively need to access.…”

“…Besides, a benign (non-malicious) extension can be buggy, allowing adversaries to exploit its vulnerabilities in order to get access to user sensitive data. One type of adversary that can exploit such vulnerabilities in extensions is the web attacker [9], [10], [13]. Indeed for security reasons, extensions and web applications execute in different and isolated contexts.…”

“…Bandhakavi et al [9] and Carlini et al [10] found that a few extensions manipulate data extracted from webpages without sanitization, leading to privileged escalations, because such data can be influenced by a web attacker. Calzavara et al [13] found that message passing APIs can be abused for privilege escalation, and formally characterized the privileges that be exploited by a web attacker.…”

“…Similarly to those studies, our threat model considers the web application as the attacker. Specifically, we seek to study at large scale, the security and privacy implications of message passing APIs [13] among extensions in the wild, whether there are extensions that can be exploited by web applications to access sensitive user information. For instance, an extension can set up an interface (register a listener) to receive from web applications, messages consisting of the URL of a resource (data) hosted by another web application.…”