• Corpus ID: 8158801

Chrome Extensions: Threat Analysis and Countermeasures

  title={Chrome Extensions: Threat Analysis and Countermeasures},
  author={Lei Liu and Xinwen Zhang and Guanhua Yan and Songqing Chen},
The widely popular browser extensions now become one of the most commonly used malware attack vectors. [] Key Result Using a prototype developed on the latest Chrome browser, we show that they can effectively mitigate the threats posed by malicious Chrome extensions with little effect on normal browsing experience.

Figures and Tables from this paper

Analyzing the dangers posed by Chrome extensions

This paper presents a series of attacks by which Chrome extensions can steal data, track user behavior, and collude to elevate their privileges, and shows that subtler versions can be devised that are less likely to be prevented by proposed defenses and can evade notice by the user.

Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies

Two attacks that bypass access control techniques in every major browser family are presented, enabling enumeration attacks against the list of installed extensions and an attack that takes advantage of poor programming practice, affecting a large number of Safari extensions are presented.

Hardening the security analysis of browser extensions

This study reveals novel password stealing, traffic stealing, and inter-extension attacks and suggests several avenues for the countermeasures against the uncovered attacks, ranging from refining the permission model to mitigating the attacks by declarations in manifest files.

An Evaluation of the Google Chrome Extension Security Architecture

A security review of 100 Chrome extensions finds that banning HTTP scripts and inline scripts would prevent 47 of the 50 most severe vulnerabilities with only modest impact on developers.

Securing Legacy Firefox Extensions with SENTINEL

Sentinel, a policy enforcer for the Firefox browser that gives fine-grained control to the user over the actions of existing JavaScript Firefox extensions, shows that the prototype implementation can effectively prevent concrete, real-world Firefox extension attacks without a detrimental impact on users' browsing experience.

ExtensionGuard: Towards runtime browser extension information leakage detection

The ExtensionGuard is an optimized and customizable dynamic taint tracking system that can closely track the sensitive information processed by browser extensions, and detect any information leakage events at runtime, and is evaluated against a set of malicious and benign extensions.

Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks

It is demonstrated how a combination of revelation and probing can uniquely identify 90% out of all extensions injecting content, in spite of a randomization scheme, which can in fact exacerbate the extension detection problem.

Fine-Grained Detection of Privilege Escalation Attacks on Browser Extensions

A formal security analysis of browser extensions in terms of a fine-grained characterization of the privileges that an active opponent may escalate through the message passing interface is proposed and its soundness is proved.



Protecting Browsers from Extension Vulnerabilities

This paper analyzes 25 popular Firefox extensions and finds that 88% of these extensions need less than the full set of available privileges and 76% use unnecessarily powerful APIs, making it difficult to reduce their privileges.

Enhancing web browser security against malware extensions

This paper has taken advantage of the lack of security mechanisms for browser extensions and implemented a malware application for the popular Firefox web browser, which it is claimed takes complete control of the user’s browser space, can observe all activity performed through the browser and is undetectable.

VEX: Vetting Browser Extensions for Security Vulnerabilities

This paper presents VEX, a framework for highlighting potential security vulnerabilities in browser extensions by applying static information-flow analysis to the JavaScript code used to implement extensions, and finds six exploitable vulnerabilities, three of which were previously unknown.

Verified Security for Browser Extensions

This paper presents \ibex, a new framework for authoring, analyzing, verifying, and deploying secure browser extensions based on using type-safe, high-level languages to program extensions against an API providing access to a variety of browser features, and proposes using Data log to specify fine-grained access control and dataflow policies.

Analyzing Information Flow in JavaScript-Based Browser Extensions

Sabre (Security Architecture for Browser Extensions), a system that uses in-browser information-flow tracking to analyze JSEs, is presented and it is shown that Sabre can precisely identify potential information flow violations by J SEs.

The Security Architecture of the Chromium Browser

This paper presents the security architecture of Chromium, the open-source browser upon which Google Chrome is built, and defines a threat model for browser exploits and evaluates how the architecture would have mitigated past vulnerabilities.

Secure Web Browsing with the OP Web Browser

A new browser, called the OP Web browser, is designed and implemented that attempts to improve the state-of-the-art in browser security and uses formal methods to prove that the address bar displayed within the browser user interface always shows the correct address for the current Web page.

Dynamic Spyware Analysis

A novel dynamic analysis approach that precisely tracks the flow of sensitive information as it is processed by the web browser and any loaded browser helper objects and can identify unknown components as spyware and provide comprehensive reports on their behavior.

Trust and Protection in the Illinois Browser Operating System

The Illinois Browser Operating System (IBOS), a new operating system and a new browser that reduces the trusted computing base for web browsers, and is flexible enough to enable new browser security policies, can still support traditional applications, and adds little overhead to the overall browsing experience.

Behavior-based Spyware Detection

A novel technique for spyware detection that is based on the characterization of spywarelike behavior is presented, which shows that it is possible to reliably identify malicious components using an abstract behavioral characterization.