CSP & Co. Can Save Us from a Rogue Cross-Origin Storage Browser Network! But for How Long?
- We introduce a new browser abuse scenario where an attacker uses local storage capabilities without the website's visitor knowledge to create a network of browsers for persistent storage and distribution of arbitrary data. We describe how security-aware users can use mechanisms such as the Content Security Policy (CSP), sandboxing, and third-party tracking protection, i.e., CSP & Company, to limit the network's effectiveness. From another point of view, we also show that the upcoming Suborigin standard can inadvertently thwart existing countermeasures, if it is adopted.
Author: | Juan D. Parra Rodriguez, Joachim PoseggaORCiDGND |
---|---|
URN: | urn:nbn:de:bvb:739-opus4-6561 |
DOI: | https://doi.org/10.1145/3176258.3176951 |
ISBN: | 978-1-4503-5632-9 |
Parent Title (English): | Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy |
Publisher: | ACM |
Place of publication: | New York, NY, USA |
Document Type: | Conference Proceeding |
Language: | English |
Year of Completion: | 2017 |
Date of Publication (online): | 2019/07/30 |
Date of first Publication: | 2018/03/13 |
Publishing Institution: | Universität Passau |
Release Date: | 2019/07/30 |
Tag: | Browser Security; Parasitic Computing; PostMessage; Web Security; WebRTC |
Page Number: | 3 Seiten |
Institutes: | Fakultät für Informatik und Mathematik |
Dewey Decimal Classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik |
open_access (DINI-Set): | open_access |
Licence (German): | Standardbedingung laut Einverständniserklärung |