1. A UTOMATICALLY SECURING WEB 2.0 APPLICATIONS THROUGH REPLICATED EXECUTION K. Vikram, Abhishek Prateek, Ben Livshits

2. Web Developer’s Mantra Thou shall not trust the client No data integrity No code integrity

3. Security vs. Performance responsiveness security Web 1.0: ASP.NET PHP Web 2.0: AJAX Silverlight Ripley With Ripley, placing computation on the client does not reduce computational integrity

4. The Volta Distributing Compiler http://volta/ IL-to-IL IL-to-JS Server Client JS.NET DLL

5. Client Volta Deployment Server Client

6. Ripley Architecture

7. 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Server Replica Client Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e

8. Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e Client Client-side code instrumented Rewrite event handlers Capture “default” events Buffer events for performance Server Replica button.onClick = function buttonHandler(e) { var obj = eventTrigger(e); var notify = document.getElementById && document.getElementById('notify'); notify.value = 'You clicked on ' + obj.value; return true; }; button.onClick = function buttonHandler(e) { ripleyEnqueue(e); // inserted by rewriting var obj = eventTrigger(e); var notify = document.getElementById && document.getElementById('notify'); notify.value = 'You clicked on ' + obj.value; return true; };

9. Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Client Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e Server Replica Run replica in a Ripley emulator Run in.NET, not in JavaScript, 100x speed increase

10. Experimental Evaluation

11. Ripley Applications Shopping cart Sudoku Blog Speed typing Online Quiz Distributed online game http://ll-ripley/ripley-samples

12. Performance Overhead Summary

13. Ripley: Vision for the Future Secure-by-construction Software + Services Ripley server farm Web 2.0 App

14. The End.