By Adam Barth, Joel Weinberger and Dawn Song.  Current JavaScript Security Model  Cross-Origin JavaScript Capability Leaks  Capability Leak Detection.

Slides:

Advertisements

Similar presentations

Presented by Vaibhav Rastogi. Current browsers try to separate host system from Web Websites evolved into web applications Lot of private data on the.

Advertisements

Context-Sensitive Auto-Sanitization In Web Templating Languages Using Type Qualifiers Prateek Saxena UC Berkeley Mike Samuel Google Dawn Song UC Berkeley.

Presented By: Brent Strange Browser Compatibility Testing Risk Analysis Learn the art of trimming browsers from a browser compatibility test list by knowing.

ForceHTTPS: Protecting High-Security Web Sites from Network Attacks Collin Jackson and Adam Barth.

ANGULAR JS ROBERTO GUTIERREZ. WHAT IS IT? Toolset for building the framework for application development Angular models are plain old javascript Developed.

Nick Guo, Ulysses Wang JavaScript De-Obfuscation Engine -- JDOE.

An Evaluation of the Google Chrome Extension Security Architecture

Extrusion Testing …testing your controls “inside-out” against the threats that actually matter! Panos Dimitriou, MSc InfoSec, CISSP,CISM Director, Managed.

JShield: Towards Real-time and Vulnerability-based Detection of Polluted Drive-by Download Attacks Yinzhi Cao*, Xiang Pan**, Yan Chen** and Jianwei Zhuge***

1 eLSE Builder Asya Stoyanova-Doycheva University of Plovdiv

Software Security Lecture 6 Fang Yu Dept. of MIS, National Chengchi University Spring 2011.

A Large-Scale Study of Mobile Web App Security Patrick Mutchler, Adam Doupe, John Mitchell, Chris Kruegel, Giovanni Vigna.

Web Security Model CSE 591 – Security and Vulnerability Analysis Spring 2015 Adam Doupé Arizona State University

Nozzle: A Defense Against Heap-spraying Code Injection Attacks Paruj Ratanaworabhan, Cornell University Ben Livshits and Ben Zorn, Microsoft Research (Redmond,

INTRODUCTION The Group WEB BROWSER FOR RELATION Goals.

Multiple Tiers in Action

Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Sponsored by the U.S. Department of Defense © 2000 by Carnegie Mellon.

Varun Sharma Security Engineer | ACE Team | Microsoft Information Security

Frame isolation and the same origin policy Collin Jackson CS 142 Winter 2009.

JShield: Towards Real-time and Vulnerability-based Detection of Polluted Drive-by Download Attacks Yinzhi Cao*, Xiang Pan**, Yan Chen** and Jianwei Zhuge***

What is HTML5? HTML5 is the new LEGO for both designers and programmers.

Presented by…. Group 2 1. Programming language 2Introduction.

FLOWFOX A WEB BROWSER WITH FLEXIBLE AND PRECISE INFORMATION CONTROL.

Is Your Website Hackable? Check with Acunetix Web Vulnerability Scanner. Acunetix Web Vulnerability Scanner V9.

Browserscope O'Reilly Velocity OLC Dec 8,

JavaScript Heap Analysis: From Browser Exploits to Safe JavaScript Subsets Adam Barth Joel Weinberger Matt Finifter Dawn Song University of California,

CS 325: Software Engineering April 14, 2015 Software Security Security Requirements Software Security in the Life Cycle.

©Ian Sommerville 2006Software Engineering, 8th edition. Chapter 30 Slide 1 Security Engineering 1.

Module 6 Using the Internet for Working & Learning.

By: Rick A. VanVolkinburg.  WebView – displays web pages inside application.  JavaScript is disabled.  Enable: webview.getSettings().setJavaScriptEnabled(true);

Adam L. Jacobs, CISSP Principal Program Manager, Oracle 15/16 November 2005 Why is Commercial Software So Vulnerable (and How Can We Fix It)?

JSProxy: Safety from Javascript Benjamin Prosnitz, Tang Yi, Yinzhi Cao.

Matrix Mapping Tool Sam Gross Internship at Virtual Technology Corporation.

SOFTWARE QUALITY IN WEB DEVELOPMENT Adam Westerman Caio Balthazar Daniel Schepers.

ZigZag: Automatically Hardening Web Applications Against Client-side Validation Vulnerabilities Presented by Xianchen Meng CSCI 680 Advanced System and.

Protecting Browsers from Extension Vulnerabilities (NDSS 2010) Adam Barth, Adrienne Porter Felt, Prateek Saxena University of California, Berkeley {abarth,

ANTIVIRUS SOFTWARE.  Antivirus software is the most widespread mechanism for defending individual hosts against threats associated with malicious software,

Defending Browsers against Drive-by Downloads:Mitigating Heap-Spraying Code Injection Attacks Authors:Manuel Egele, Peter Wurzinger, Christopher Kruegel,

FireBug. What is Firebug?  Firebug is a powerful tool that allows you to edit HTML, CSS and view the coding behind any website: CSS, HTML, DOM and JavaScript.

Protecting Browsers from Extension Vulnerabilities Paper by: Adam Barth, Adrienne Porter Felt, Prateek Saxena at University of California, Berkeley and.

An Analysis of the Mozilla Jetpack Extension Framework Rezwana Karim, Mohan Dhawan, Vinod Ganapathy Computer Science, Rutgers University Chung-cheih Shan.

Towards Client Side HTML Security Policies Joel Weinberger, Adam Barth, Dawn Song.

Welcome and Logistics Joel Butler Fermilab. Outline Welcome from organizers Welcome from Fermilab Logistics.

PRESENTERS: AMOL KOKJE, STEVEN OSBURN, SUNIT VERMA, TOSHA SHAH, KALP PARIKH Vetting Mobile Apps.

WebShield: Enabling Various Web User Defense Techniques without Client Side Modifications Yan Chen Lab for Internet and Security Technology (LIST) Northwestern.

TEMPLATE DESIGN © Crawling is the process of automatically exploring a web application to discover the states of the application.

NESSUS. Nessus Vulnerability Scanner Features: Ease of use Deep Vulnerability Analysis Discover network based and local vulnerabilities Perform configuration.

By: Chuqing He. Android Overview - Purchased by Google in First Android Phone was sold in Oct Linux-based - Holds 75% of the worldwide.

Building a Chrome extension Chance Feick |. Outline History Development – Manifest File – Content Scripts – chrome.* API Installation Deployment Live.

Introduction to WebKit Girish Ramakrishnan. History

HTML...CSS...JAVASCRIPT for Higher Computing Science.

Static Detection of Cross-Site Scripting Vulnerabilities

“Nodes of Distributed Systems”

Small Engine Tool ID Part 1.

Who Am I? Michael Dale Recent Graduate, University of California, Santa Cruz Developer of Metavid (metavid.org)

KnockoutJS -Pradeep Shet 31st August 2014.

Mozilla Firefox Toll free number. Want to take user reviews and genuine feedback on mozilla firefox then check out the link- Mozilla Firefox Phone NumberMozilla.

Jon Peppler, Menlo Security Channels

HTML5 Platform from Web to Apps

October is National Cyber Security Awareness Month

Miami Valley Computer Science Circle

CSC 495/583 Topics of Software Security Intro to Web Security

Unit 6 part 3 Test Javascript Test.

Procedure for adding a Trusted Site

Client-Server Model: Requesting a Web Page

Murach's JavaScript and jQuery (3rd Ed.)

Presentation transcript:

By Adam Barth, Joel Weinberger and Dawn Song

 Current JavaScript Security Model  Cross-Origin JavaScript Capability Leaks  Capability Leak Detection  Browser Defense Mechanism

 The DOM provides an access control layer  The JavaScript engine treats objects as capabilities

 Current JavaScript Security Model  Cross-Origin JavaScript Capability Leaks  Capability Leak Detection  Browser Defense Mechanism

 Current JavaScript Security Model  Cross-Origin JavaScript Capability Leaks  Capability Leak Detection  Browser Defense Mechanism

 In the JavaScript Engine object system  Object creation, destruction and reference  Calls into analysis library

 Current JavaScript Security Model  Cross-Origin JavaScript Capability Leaks  Capability Leak Detection  Browser Defense Mechanism

 Heap Graph Analysis can be used to find vulnerabilities in web browser  Web Browser can provide mechanism to eliminate these vulnerabilities  Heap Graph Tool and Access Control Prototype for WebKit: