1. The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5Websites Sooel Son and Vitaly Shmatikov The University of Texas at Austin 20 th NDSS Symposium (February 2013)

2. Introduction O Web browsers isolate content by on its origin. O same origin policy O Popular sites often include third-party content. O advertisements O buttons for social recommendations O … O They need to communicate with each other. 2013/3/25 A Seminar at Advanced Defense Lab2

3. HTML5 O HTML5 includes the postMessage facility that enables a script to send a message to a window regardless of their respective origins. [link]link 2013/3/25 A Seminar at Advanced Defense Lab3

4. postMessage O Sender (may be invoked by third-party script) O window.postMessage( message, targetOrigin [, transfer ] ) O Browser use targetOrigin to verify window 2013/3/25 A Seminar at Advanced Defense Lab4

5. Message Event O The event listener may be registered by third-party script O Some message event object members O data O origin O The sender’s origin O source O It represents the WindowProxy of the browsing context of the Window object from which the message came 2013/3/25 A Seminar at Advanced Defense Lab5

6. Two Problems about postMessage O Senders need to specify targetOrigin O Barth et al. USENIX Security 2008 O Recievers need to verify event.origin O This paper 2013/3/25 A Seminar at Advanced Defense Lab6