BrowserShield: Vulnerability-Driven Filtering of Dynamic HTML Charles Reis, John Dunagan Helen J. Wang, Opher Dubrovsky and Saher Esmeir Presented by Hongyu Gao Feb. 26, 2009

Outline Introduction Overview of BrowserShield Implementation Evaluation Conclusions

WEB BASED ATTACKS Web Based Attacks Web browser exploits are common examples: Buffer overflows, ActiveX flaws, etc. - -- 19 critical vulnerabilities, 8 patches in 2005 - --16 critical vulnerabilities, 7 updates in 2005

Challenges & Solution It cannot be statically determined whether an embedded script will exploit the browser at runtime. This work addresses the problem by rewriting web pages and any embedded scripts into safe equivalents, inserting checks The filtering is done at runtime.

BrowserShield Overview Policies HTML + JavaScript BrowserShield Logic Injector Shielded HTML and JavaScript Web server Client Browser © 2007 Microsoft Corporation 5

© 2007 Microsoft Corporation Deploy BrowserShield Can be deployed anywhere Firewall Browser extension Web publisher © 2007 Microsoft Corporation 6

Working of Browser shield Two steps of re-writing to translate webpage into safe equivalents They are i. T-HTML ii. T-SCRIPT

T-HTML 1. Modify page according to policies 2. Wrap the script elements

T-SCRIPT

T-script example

Characteristics of Browser shield Complete interposition Tamper-proof Transparency Flexible policies

Complete Interposition Rewrite and apply policy to: Function and method calls Object property reads/writes Object creations

Tamper proof & Transparency Hide BrowserShield code Rename variables, handle reflection Shadow copies of untranslated code Preserve context for “this”

Flexibility Separating mechanism from policy For example, if an undocumented API is discovered that can manipulate the document tree, we simply add a new policy to interpose on this API.

Evaluation Firewall-based prototype Protect IE’s vulnerabilities: IE’s handling of (i) HTML, script,or ActiveX components, (ii) HTTP, and (iii) images or other files

Evaluation Table II shows how many vulnerabilities there were in each area, and whether BrowserShield or another technology could provide patch-equivalent protection

Evaluation On Average, 94% increase (216% worst case)

Conclusion Script rewriting can protect web clients - Vulnerability-driven filtering - Transforms content, not browsers General framework BrowserShield can also serve as a platform for other new functionality on the Web,

QUESTIONS ? THANK YOU