Towards fine-grained access control on browser extensions

Authors:
Lei Wang;Ji Xiang;Jiwu Jing;Lingchen Zhang
Affiliations:
State Key Lab of Information Security, Graduate University of CAS, China;State Key Lab of Information Security, Graduate University of CAS, China;State Key Lab of Information Security, Graduate University of CAS, China;State Key Lab of Information Security, Graduate University of CAS, China
Venue:
ISPEC'12 Proceedings of the 8th international conference on Information Security Practice and Experience
Year:
2012

Citing 5
Cited 1

Extensible Web Browser Security

DIMVA '07 Proceedings of the 4th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Analyzing Information Flow in JavaScript-Based Browser Extensions

ACSAC '09 Proceedings of the 2009 Annual Computer Security Applications Conference
VEX: vetting browser extensions for security vulnerabilities

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
Securing script-based extensibility in web browsers

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
Vetting browser extensions for security vulnerabilities with VEX

Communications of the ACM

Securing legacy firefox extensions with SENTINEL

DIMVA'13 Proceedings of the 10th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment

Quantified Score

Hi-index	0.00

Visualization

Abstract

We propose a practical and fine-grained browser extension access control framework, which regulates the misbehavior of JSEs with malicious intent at run time by means of restricting the access to resources, in order to prevent the malicious JSEs from ruining users security. The resource access of a JSE, which constrains its behavior, is the basis of the functionalities of it. Instead of the conventional static access control rules, we formulate the fine-grained access control policies dynamically in the framework while JSEs are executing within Firefox, which makes our framework more flexible and practical in real-world use. We tested 100 popular JSEs on AMO to evaluate the compatibility of our framework, and found that only two of them are not compatible due to their sensitive behavior. To evaluate the capability of restraining the misbehavior of JSEs, we tested ten malicious ones and the results show that all of them are blocked by our framework before they actually misbehave.