TY - CONF A1 - Parra Rodriguez, Juan D. A1 - Posegga, Joachim T1 - CSP & Co. Can Save Us from a Rogue Cross-Origin Storage Browser Network! But for How Long? T2 - Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy N2 - We introduce a new browser abuse scenario where an attacker uses local storage capabilities without the website's visitor knowledge to create a network of browsers for persistent storage and distribution of arbitrary data. We describe how security-aware users can use mechanisms such as the Content Security Policy (CSP), sandboxing, and third-party tracking protection, i.e., CSP & Company, to limit the network's effectiveness. From another point of view, we also show that the upcoming Suborigin standard can inadvertently thwart existing countermeasures, if it is adopted. KW - Web Security KW - WebRTC KW - PostMessage KW - Browser Security KW - Parasitic Computing Y1 - 2019 UR - https://opus4.kobv.de/opus4-uni-passau/frontdoor/index/index/docId/656 UR - https://nbn-resolving.org/urn:nbn:de:bvb:739-opus4-6561 SN - 978-1-4503-5632-9 PB - ACM CY - New York, NY, USA ER -