Securing Frame Communication in Browsers

1. Securing Frame Communication in Browsers 17th USENIX Security Symposium (2008) Adam Barth, Collin Jackson, John C. Mitchell 2008.11.27

2. Agenda Background Problem Definition Goal & Contribution Frame Isolation Frame Communication Related Work Conclusion

3. Background : Mashup From Daum From Google From NASA • A Web site combining content from multiple sources • Integrator • Combining the contents • Gadget • Integrated contents

4. Background : Mashup • Mashup use two method for implementation • Insert JavaScript • The integrator embeds a <script> tags • The script runs with all of the integrator’sprivileges • Iframe element • Can represent different principal • Frame can draw only on its own rectangle

5. Problem Definition • The frames can contain untrusted content • Try to access the other frames for malicious action • Web attacker • Owns an attacker.com • User visits attacker.com • Optional assumption • Gets to embeds a malicious gadget on integrator site

6. Goal & Contribution • Enhance the security on Mashup included untrusted gadget • Isolation between each frames • Propose the security policy. • Secure frame communication • Make up for the weak points in existing approaches

7. Frame Isolation : Navigation Policy • Permissive Policy • A frame can navigate any other frame • Cross-Window Attacks

8. Frame Isolation : Navigation Policy Gadget Hijacking • Window Policy • A frame can navigate only frames in its window

9. Frame Isolation : Navigation Policy • Child Policy • A frame can navigate only its direct children • Reduce the policy’s compatibility with existing sites • Descendant Policy • A frame can navigate only its descendants • Provide the most attractive trade-off between security and compatibility

10. Frame Isolation : Navigation Policy Policy Behavior

11. Frame Isolation : Deployment • Safari • Apple accepted author’s patch about descendant policy • Firefox • Mozilla accepted author’s patch in Firefox 3 • Flash • Adobe agreed about descendant policy • Opera • They plan to fix these vulnerabilities

12. Frame Communication • Security Properties • Confidentiality • A message can be read only by its intended recipient • Authentication • The Ability of the recipient to unambiguously determine the sender of a message • Some Mashup need to communication method for providing rich content • The fragment Identifier channel • postMessage Channel

13. Frame Communication : The Fragment Identifier Channel Frame 2 SetInterval(checkForMessge,200); Frame 1 Parent.location=http://aaa.com/#Message_1230483 • The fragment identifier • http://aaa.com/#hello • Send short information to other frame using the fragment identifier • Doesn’t reload content in the frame • No network traffic, but frame can read its fragment

14. Frame Communication : The Fragment Identifier Channel • Security properties • Confidentiality : Yes • Authentication : No • Not a secure channel • Windows Live channel • Attempts to build a secure channel over the fragment identifier channel • Smesh and Open Ajax 1.1

15. Frame Communication : The Fragment Identifier Channel • Windows Live channel • The Lowe anomaly can be exploited to impersonate the integrator • Smesh and Open Ajax 1.1

16. Frame Communication : The Fragment Identifier Channel • Secure Fragment Messaging • The fragment identifier channel can be secured using a variant of the Needham-Schroeder-Lowe Protocol • The responder must include his identity in the second message of the protocol

17. Frame Communication : The Fragment Identifier Channel • Adoption • Microsoft : Windows Live Channels library • IBM : OpenAjax Hub 1.1

18. Frame Communication : The postMessage Channel • New API for inter-frame communication in the HTML 5 • Supported in latest betas of many browsers • IE 8, Firefox 3,Safari, Opera • To send a message to another frame, the sender calls the postMessage method • frame[0].postMessage(“Hello world.”); • The browser generates a message event in the recipient’s frame • Contain message, the origin of the sender, a JavaScript pointer to sender’s frame

19. Frame Communication : The postMessage Channel • Security properties • Confidentiality : No • Authentication : Yes • Not a secure channel • Two type attack method • Recursive Mashup Attack • Replay Attack

20. Frame Communication : The postMessage Channel Attacker • Recursive Mashup attack • The attacker load the integrator inside a frame • Can carry out an attack without violating the descendant frame policy • Attacker hijacks content of postMessage

21. Frame Communication : The postMessage Channel • Replay attack • Embedding the honest gadget in attacker’s frame • Can intercept postMessage, even under the child frame policy

22. Frame Communication : The postMessage Channel • Securing postMessage • Let the sending specify the recipient • frame[0].postMessage(“hello”,http://gadget.com) • Can omit argument if confidentiality not required • Adoption • HTML 5.0 • Firefox 3 • Safari • IE 8

23. Related work • Safe subsets of HTML and Javascript • This approach require gedgets to be written in a “safe subset” of HTML and JavaScript • Writing programs in one of these safe subsets is often awkward • Subspace • This approach used a multi level hierarchy based on document.domain property • The descendant frame navigation policy is required to prevent gadget hijacking. • MashupOS

24. Conclusion • All proposals deployed to real users • Frame isolation • Improved frame navigation policy • Frame communication • Secured fragment identifier messaging • Secured new postMessage API

25. Q&A