User Interface Toolkit Mechanisms For Securing Interface Elements Franziska Roesner, James Fogarty, Tadayoshi Kohno Computer Science & Engineering DUB Group, Security & Privacy Research Lab University of Washington

Like us on Facebook! User Interface Toolkits Ease interface design and implementation. Provide developers with flexibility and expressivity. Assumption: Developers have full control of an interface. New Challenge: Modern interfaces include elements implemented by different developers. Ad from ad library Social button from Facebook library 2 Map from Google library

Like us on Facebook! Attack #1: Programmatic Click Fraud 3 Ad Server App Developer User Click Programmatic Click

Like us on Facebook! Attack #2: Size Manipulation 4 Android requires applications to display a camera preview in order to take a photo. 1 pixel X 1 pixel camera preview

Attack #3: Eavesdropping 5 NEW! Login with your Google account! Interface Layout Tree Background {App} LoginBox {Google} Text {App} Interface Layout Tree Background {App} LoginBox {Google} Text {App} Terminology: Code from different developers is in different trust groups.

Interface Layout Tree Background {App} LoginBox {Google} Text {App} Attack #3: Eavesdropping 6 App Developer NEW! Login with your Google account! ********

Like us on Facebook! Attack #4: Display Takeover 7 Widget parent = adWidget.getParent(); parent.removeChildren(); parent.addChild(fullScreenAd); Ad Library Code

An Opportunity for Toolkits These vulnerabilities are in the user interface. Existing solutions come at the expense of interface usability and flexibility. 8 Addressing these vulnerabilities in the user interface toolkit provides better security and enables new interfaces.

Desired Security Properties 1.Display Integrity 2.Input Integrity 3.Intent Integrity 4.Data Isolation 5.UI-to-API Links 9

Desired Security Properties 1.Display Integrity 2.Input Integrity 3.Intent Integrity 4.Data Isolation 5.UI-to-API Links 10

Desired Security Properties 1.Display Integrity 2.Input Integrity 3.Intent Integrity 4.Data Isolation 5.UI-to-API Links 11 Protect the display of interface elements across trust groups. Like us on Facebook! Recall the attacks: Size Manipulation Display Takeover

Recall the attack: Programmatic Click Fraud Like us on Facebook! Desired Security Properties 1.Display Integrity 2.Input Integrity 3.Intent Integrity 4.Data Isolation 5.UI-to-API Links 12 Prevent programmatic interaction with interface elements across trust groups.

Desired Security Properties 1.Display Integrity 2.Input Integrity 3.Intent Integrity 4.Data Isolation 5.UI-to-API Links 13 Protect displayed content and input across trust groups. Recall the attack: Eavesdropping NEW! Login with your Google account!

Architecting a Toolkit for Security 14 Techniques: Isolating trust groups Interface layout tree invariants Model-level event listeners Composition across trust groups Flexible feedback (for drag-and-drop, lenses) Goals: (1) Achieve our desired security properties. (2) Maintain usability and developer flexibility.

Architecting a Toolkit for Security 15 Techniques: Isolating trust groups Interface layout tree invariants Model-level event listeners Composition across trust groups Flexible feedback (for drag-and-drop, lenses) Goals: (1) Achieve our desired security properties. (2) Maintain usability and developer flexibility.

Interface Layout Tree Vulnerabilities 16 (1) Insecure Layout: Parent elements can manipulate the layout of the child elements. Recall the attack: Size Manipulation Size Request Problem: In a traditional layout tree, there is no guarantee of a trusted path to every node.

Interface Layout Tree Vulnerabilities 17 Input Events (2) Insecure Input: Parents can eavesdrop on or modify events intended for children. Recall the attack: Eavesdropping NEW! Login with your Google account! Problem: In a traditional layout tree, there is no guarantee of a trusted path to every node.

Interface Layout Tree Invariants Solution: Introduce new invariants: 1.The root node of an application’s layout tree must be a system node. 2.Only system nodes may have children of a different trust group. 18 system Input Events Size Request system

Interface Layout Tree Invariants How to do visual embedding? 19 Solution: Introduce a system-trusted proxy node into the layout tree. The proxy node is introduced automatically and can be transparent to the developer. NEW! Login with your Google account! Background {App} LoginBo x {Google} Text {App} Proxy {System} Root {System} Background {App} LoginBox {Google} Text {App} Root {System}

More in the paper! Techniques for flexibility – Exposing model-level APIs across trust groups – Composing trust groups in one interface element – Supporting feedback (drag-and-drop, lenses) 20 NEW! Login with your Google account! Prototype implementations for Android and a web browser Login token Like us on Facebook!

Conclusion Questions for future work and discussions: – What are appropriate defaults for access to APIs across trust groups? – What new interfaces will a secure toolkit enable? 21 A security-aware toolkit architecture can achieve security properties while maintaining developer flexibility.

User Interface Toolkit Mechanisms For Securing Interface Elements Franziska Roesner, James Fogarty, Tadayoshi Kohno Computer Science & Engineering DUB Group, Security & Privacy Research Lab University of Washington This work was supported by the NSF under Graduate Research Fellowship award DGE as well as awards CNS and IIS