PrivacyPreserving BrowserSide Scripting With BFlow Alexander Yip Neha

Privacy-Preserving Browser-Side Scripting With BFlow Alexander Yip, Neha Narula, Maxwell Krohn, Robert Morris Massachusetts Institute of Technology

Web Sites Support 3 rd Party Java. Script Extensions • Blogger. com supports “widgets” – read and modify blog posts Snippets of the last few blog posts Display the last few reader comments

Confidential Blogs Are Vulnerable to 3 rd Party Java. Script v

A 3 rd Party Java. Script Leak Attack Widget has access to private blog content Widget’s Java. Script source code: Widget leaks private blog private_data = document. get. Element. By. Id(“posts”); Showsto private blog content attacker. com widget. inner. HTML = private_data; in widget’s box • Blogger. com wants to provide data to content widgets widget. inner. HTML += • ‘<IMG Browser security policy permitsprivate_data JS to send data freely SRC=http: //attacker. com/’+ +‘. gif>’; • Wrote a malicious blogger. com widget in one hour Alice’s Browser attacker. com Server Blogger JS + Attacker JS HTTP Request: GET /sell_pet_food_online. gif HTTP/1. 0

Problem: Extensibility vs. Privacy (Choose one) • Either choose cool extensibility features – e. g. Blogger. com widgets • Or choose privacy and no 3 rd party code – e. g. Gmail oitotouroiejfjlf lkjljvojubjjcjif Zlxcoizvuowqjlsavzmzlvcjlsadfjfoqwojerl, clvzlxcvjaoi sjqklqwerljdsalzzx, vcnadsoqoiewqoirulnzdlkfjaoique oqejlnlvkjxzcoivuaqoeruqowejrlkasdnzcvzxvalsdfou qoweurozxcvjlkajoqewjrlsdznlkzxvjzl Dan’s Spell Joe’s Encryption Checker Widget Encrypt Mail Check Spelling! Decrypt Mail

Solution: BFlow • Eliminate the choice between features & privacy • Add information flow control (IFC) – To Java. Script in the browser – Track private data inside the browser and server • Prohibit communication that leaks private data

Challenges • Fit Java. Script environment into an IFC model – Preserve Java. Script communication channels – Mashups with private data • Easy to Send to adopt sub-frame Send to toplevel frame – Minimize changes to JS that uses existing communication channels Private address – Minimize changes required on the server Google Maps Server – Easy for end-users to start using

Contributions • An IFC model for the JS runtime environment • Easy to deploy and adopt implementation – Installs in browser with 2 clicks – Requires no changes to Java. Script interpreter • Only small changes to Java. Script communication API • A platform that supports real blogger. com widgets

BFlow Overview Trusted Protection Zone Untrusted Protection Zones Blog Server Supplies Some HTML/JS Blog Server “labels” private data with a “tag” Label: Saw Alice’s private data Browser Reference Monitor Blog Web Server Reference Monitor knowsattacker. com Server when a zone reads private data 3 rd Party Supplies Widget HTML/JS

BFlow Overview Declassification: Fetch Map Image from Google Maps, OK! Have not seen private data: Can send requests Blog Web Server to any server Have seen private data: Can only send requests to the data’s server attacker. com Server Google Maps Server BFlow prevents the malicious widget from Browser Reference Monitor leaking private data

Design Outline • • Tags and Labels Protection Zones Reference Monitor Server

Tags And Labels • A label is a set of tags – Describes what private data an object contains – Each zone, HTTP request, and response has a label • Each tag identifies a kind of private data – Alice’s tag: blogger. com: alice – Bob’s tag: blogger. com: bob • e. g. Alice’s blog has label L={blogger. com: alice}

Data Flow Rule • Data may flow only if Ldata Lreceiver Data ? Receiver Java. Script Data Label Receiver Label May Receive {x} {x, y} Yes {x} {} No

Protection Zones • A zone is a group of browser HTML <frames> – Regular Java. Script runs inside a frame inside a zone – All frames in a zone share the same label • Trusted zone – Top-level frame is in the site’s trusted zone – Contains Java. Script written only by the site’s developers – Need not abide by information flow restrictions • Untrusted zones – Contain 3 rd party Java. Script – Must abide by information flow restrictions

Example Zones & Labels Trusted Zone (No Label) Zone A L={} Zone C L={} Zone B L={blogger. com: alice} Zone D L={blogger. com: alice}

How Do Untrusted Zones Get Labels? Trusted zone sets untrusted zone’s label augment_label (blogger. com: alice) L={blogger. com: alice} L={} Blog Web Server Browser Reference Monitor

Works With Existing JS Channels • Channel 1: A frame can always send to its child frame – Lparent Lchild • Channel 2: A frame can always send to the top-level frame – To avoid leaking data, untrusted zones may contain only tags from the web site in the top-level frame Web Page Showing Inherent Java. Script Channels Top-level Frame from X. com Frame 1 L={X. com: A} Frame 2 L={X. com: A, X. com: B} Frame 1 may not add X. com: C to its label No sub-frame from X. com may add a tag from Y. com

Why Zones Instead Of Frames? • Some Java. Script consists of multiple frames • Group Java. Script into modules by label – All frames in the same zone can always communicate – Trusted Java. Script sets the label of a multi-frame widget only once – Existing multi-frame widgets need not coordinate label changes e. g. Cbox chat widget Bottom frame writes messages to top frame

BFlow‘s Java. Script Model • All Java. Script will work if the IFC rules allow – AJAX, eval() • The IFC rule (Ldata Lreceiver) affects – access to DOM variables & cookies – post. Message(), fragment-ID messages – HTTP requests and responses

HTTP Request Rules • Trusted zone T – can send to any server (always) – can receive a response from any server (always) • Untrusted zone Z – can send to the server where secret data came from (always) • can receive the response (when Lresponse LZ) – can send to 3 rd party server E (when LZ = {}) • or web site has a declassification exception for (server E, URL) • can receive the response (always)

The BFlow Server API • Propagate label from HTTP requests to responses – Read label contained in each request – Attach the label to any response that uses labeled data HTTP Request: POST save_post? content=sell_petfood_online Label: L = {blogger. com: alice} Zone A L={blogger. com: alice} Blog Web Server L={blogger. com: alice} Zone B L={blogger. com: alice} HTTP Response Contents: sell_petfood_online Label: L = {blogger. com: alice}

BFlow Implementation No changes to Java. Script interpreter Java. Script communication API changed slightly Firefox Extension 1100 Lines of code Users can install with 2 clicks Browser Reference Monitor

Zone Isolation • Repurpose browser’s same-origin policy (SOP) – Zones communicate via reference monitor – SOP is conservative: no DOM read/write across zones even if labels would allow Domain name: Zone 1. blogger No direct communication Domain name: Zone 2. blogger

Applications • BF-Socialnet – Social network that supports 3 rd party JS extensions – Protects private user data (see paper) • BFlogger – Blog mockup that supports blogger. com widgets – Ported 12 existing widgets to BFlogger

BFlow Preserves Privacy • Wrote a malicious Blogger. com widget – Successfully leaks data from confidential blogs • Ported widget to BFlogger – BFlow prevents malicious widget from leaking data attacker. com Server No requests to attacker. com after reading private data

BFlow Runs Existing Java. Script • Better privacy with little or no changes Widget Lines of Code Lines Changed Uses Secret Data? Twitter 25 0 No Flickr 10 0 No Buzz 1 0 No Youtube 1982 0 No Calendar 1945 0 No Weather 3790 0 No Popular Posts 16 1 Yes Commenters 15 1 Recent Posts 74 2 Random Post 34 2 Yes Cbox-chat 801 89 Yes we made Chat store data High because on the BFlow Yes server to protect chat data

Existing Research • • • Can’t grant read access without also leaking [Mashup. OS] Requires rewriting Java. Script & manual jail config [Caja] Don’t support untrusted Java. Script [Swift, SIF] User must make disclosure decisions [No. Mo. XSS] Certificates [Java]

Conclusion • 3 rd party Java. Script can leak confidential user data • BFlow provides a new web security model – Tracks information flow between client & server – 3 rd party Java. Script can safely compute and display – Enables new features in web sites • e. g. 3 rd party Gmail extensions Questions