Time Does Not Heal All Wounds: A Longitudinal Analysis of Security-Mechanism Support in Mobile Browsers

Abstract

Recent market share statistics show that mobile device traffic has overtaken that of traditional desktop computers. Users spend an increasing amount of time on their smartphones and tablets, while the web continues to be the platform of choice for delivering new applications to users. In this environment, it is necessary for web applications to utilize all the tools at their disposal to protect mobile users against popular web application attacks. In this paper, we perform the first study of the support of popular web-application security mechanisms (such as the Content-Security Policy, HTTP Strict Transport Security, and Referrer Policy) across mobile browsers. We design 395 individual tests covering 8 different security mechanisms, and utilize them to evaluate the security-mechanism support in the 20 most popular browser families on Android. Moreover, by collecting and testing browser versions from the last seven years, we evaluate a total of 351 unique browser versions against the aforementioned tests, collecting more than 138K test results. By analyzing these results, we find that, although mobile browsers generally support more security mechanisms over time, not all browsers evolve in the same way. We discover popular browsers, with millions of downloads, which do not support the majority of the tested mechanisms, and identify design choices, followed by the majority of browsers, which leave hundreds of popular websites open to clickjacking attacks. Moreover, we discover the presence of multi-year vulnerability windows between the time when popular websites start utilizing a security mechanism and when mobile browsers enforce it. Our findings highlight the need for continuous security testing of mobile web browsers, as well as server-side frameworks which can adapt to the level of security that each browser can guarantee.

Complex Security Policy? A Longitudinal Analysis of Deployed Content Security Policies

“…In particular, XFO just supports three types of policies: DENY prevents all framing, SAMEORIGIN restricts framing to the same origin as the framed page, and ALLOW-FROM u restricts framing to a single URL u. Note that ALLOW-FROM is not even supported by all browsers (in particular Chrome and Safari), thus making XFO particularly problematic [22]. CSP, instead, may be used to allow framing from a list of arbitrarily many Web origins specified through source expressions.…”

Talking with Familiar Strangers: An Empirical Study on HTTPS Context Confusion Attacks

“…It is the misconfigured HTTP headers and the vulnerable response contents that are used for SCC attacks on secure traffic. Besides, the pervasiveness of inconsistencies among servers still affect some high profile websites [25,48,52]. Therefore, developers should pay more attention to the implementation details for security.…”

Reining in the Web's Inconsistencies with Site Policy

“…The study of inconsistencies in Web security has primarily focused on analyzing bugs leading to different levels of protection across browsers. Notably, previous work focused on incoherent implementations of the SOP [30,29], broken support for security mechanisms in mobile browsers [17], and differing guarantees in clickjacking protection [7]. Other papers also studied the inconsistent deployment of HTTP headers between the desktop and the mobile version of the same site [18,37].…”