[论文解读] Most Websites Don't Need to Vibrate: A Cost-Benefit Approach to Improving Browser Security

Peter Snyder, Cynthia Taylor+1 more|arXiv (Cornell University)|Aug 28, 2017

Advanced Malware Detection Techniques参考文献 29被引用 12

一句话总结

本文提出一种成本-收益方法论，用于评估浏览器API功能，发现大多数网站并不需要默认访问许多Web API。通过默认阻止15个低收益、高风险的API，作者实现了52.0%的CVE相关代码路径减少和50.0%的实现代码减少，同时仅导致5.3%的网站出现兼容性问题，使用基于ES6 Proxy的可配置浏览器扩展实现细粒度访问控制。

ABSTRACT

Modern web browsers have accrued an incredibly broad set of features since being invented for hypermedia dissemination in 1990. Many of these features benefit users by enabling new types of web applications. However, some features also bring risk to users' privacy and security, whether through implementation error, unexpected composition, or unintended use. Currently there is no general methodology for weighing these costs and benefits. Restricting access to only the features which are necessary for delivering desired functionality on a given website would allow users to enforce the principle of lease privilege on use of the myriad APIs present in the modern web browser. However, security benefits gained by increasing restrictions must be balanced against the risk of breaking existing websites. This work addresses this problem with a methodology for weighing the costs and benefits of giving websites default access to each browser feature. We model the benefit as the number of websites that require the feature for some user-visible benefit, and the cost as the number of CVEs, lines of code, and academic attacks related to the functionality. We then apply this methodology to 74 Web API standards implemented in modern browsers. We find that allowing websites default access to large parts of the Web API poses significant security and privacy risks, with little corresponding benefit. We also introduce a configurable browser extension that allows users to selectively restrict access to low-benefit, high-risk features on a per site basis. We evaluated our extension with two hardened browser configurations, and found that blocking 15 of the 74 standards avoids 52.0% of code paths related to previous CVEs, and 50.0% of implementation code identified by our metric, without affecting the functionality of 94.7% of measured websites.

研究动机与目标

• 为解决浏览器API功能在安全与可用性之间权衡缺乏系统性评估方法的问题。
• 以网站功能实现程度衡量每个Web API的收益，并以漏洞数量、代码复杂度及学术界利用案例衡量其成本。
• 开发一种用户可配置的浏览器扩展，按站点粒度选择性禁用高成本、低收益的API。
• 评估强化浏览器配置（限制部分Web API访问）在安全性和可用性方面的影响。
• 证明可在不破坏绝大多数网站的前提下实现显著的安全提升。

提出的方法

• 作者将每个Web API的收益建模为需要其支持以实现可见功能的网站数量。
• 通过每个API关联的CVE数量、代码行数及学术攻击案例来量化其成本。
• 基于ES6 Proxy对象构建可配置的浏览器扩展，动态禁用JavaScript API而不破坏现有代码。
• 通过识别并阻止15个低收益、高风险的Web API标准，创建两种强化浏览器配置。
• 在Alexa排名前200的网站及其余网站的随机样本上评估该扩展，将断点率与NoScript和Tor Browser Bundle进行对比。
• 该方法支持按站点配置策略，允许用户为可信来源选择性启用特定功能。

实验结果

研究问题

• RQ1 哪些Web API标准对大多数网站提供的功能收益极低，但存在显著的安全与隐私风险？
• RQ2 通过阻止部分Web API，能在多大程度上减少已知漏洞和攻击面暴露，同时不破坏现有网站？
• RQ3 与NoScript和Tor Browser Bundle等现有隐私导向工具相比，强化浏览器配置的可用性如何？
• RQ4 基于ES6 Proxy的动态、用户可配置扩展能否在不破坏功能性代码的前提下，有效实现细粒度API访问控制？
• RQ5 在选择性限制浏览器功能时，安全加固与网站兼容性之间的权衡关系如何？

主要发现

• 阻止74个Web API标准中的15个，使作者度量的CVE相关代码路径减少52.0%，实现代码减少50.0%。
• 强化配置在前200大热门网站中仅造成5.3%的断点率，在Alexa 10k的随机样本中同样为5.3%，兼容性表现优于NoScript和Tor Browser Bundle。
• 绝大多数网站（94.7%）在默认阻止高风险、低收益API（如High Resolution Time Level 2、Canvas和Web Audio）后仍能正常运行。
• 学术研究已证明，部分被阻止的API（如Canvas和Web Audio）曾被用于指纹识别和侧信道攻击，验证了风险评估的合理性。
• 基于ES6 Proxy的特性防火墙成功禁用了API，且未破坏依赖其存在的现有代码，证明了运行时拦截的可行性。
• 作者识别出Battery API、High Resolution Time Level 2、Canvas和Web Audio API为应从默认访问中移除的强候选对象，因其风险高而收益低。