CSP & Co. Can Save Us from a Rogue Cross-Origin Storage Browser Network! But for How Long?
- We introduce a new browser abuse scenario where an attacker uses local storage capabilities without the website's visitor knowledge to create a network of browsers for persistent storage and distribution of arbitrary data. We describe how security-aware users can use mechanisms such as the Content Security Policy (CSP), sandboxing, and third-party tracking protection, i.e., CSP & Company, to limit the network's effectiveness. From another point of view, we also show that the upcoming Suborigin standard can inadvertently thwart existing countermeasures, if it is adopted.
| Author: | Juan D. Parra Rodriguez, Joachim PoseggaORCiDGND |
|---|---|
| URN: | urn:nbn:de:bvb:739-opus4-6561 |
| DOI: | https://doi.org/10.1145/3176258.3176951 |
| ISBN: | 978-1-4503-5632-9 |
| Parent Title (English): | Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy |
| Publisher: | ACM |
| Place of publication: | New York, NY, USA |
| Document Type: | Conference Proceeding |
| Language: | English |
| Year of Completion: | 2017 |
| Date of Publication (online): | 2019/07/30 |
| Date of first Publication: | 2018/03/13 |
| Publishing Institution: | Universität Passau |
| Release Date: | 2019/07/30 |
| Tag: | Browser Security; Parasitic Computing; PostMessage; Web Security; WebRTC |
| Page Number: | 3 Seiten |
| Institutes: | Fakultät für Informatik und Mathematik |
| Dewey Decimal Classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik |
| open_access (DINI-Set): | open_access |
| Licence (German): | Standardbedingung laut Einverständniserklärung |

