CSP & Co. Can Save Us from a Rogue Cross-Origin Storage Browser Network! But for How Long?

  • We introduce a new browser abuse scenario where an attacker uses local storage capabilities without the website's visitor knowledge to create a network of browsers for persistent storage and distribution of arbitrary data. We describe how security-aware users can use mechanisms such as the Content Security Policy (CSP), sandboxing, and third-party tracking protection, i.e., CSP & Company, to limit the network's effectiveness. From another point of view, we also show that the upcoming Suborigin standard can inadvertently thwart existing countermeasures, if it is adopted.

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar
Metadaten
Author:Juan D. Parra Rodriguez, Joachim PoseggaORCiDGND
URN:urn:nbn:de:bvb:739-opus4-6561
DOI:https://doi.org/10.1145/3176258.3176951
ISBN:978-1-4503-5632-9
Parent Title (English):Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy
Publisher:ACM
Place of publication:New York, NY, USA
Document Type:Conference Proceeding
Language:English
Year of Completion:2017
Date of Publication (online):2019/07/30
Date of first Publication:2018/03/13
Publishing Institution:Universität Passau
Release Date:2019/07/30
Tag:Browser Security; Parasitic Computing; PostMessage; Web Security; WebRTC
Page Number:3 Seiten
Institutes:Fakultät für Informatik und Mathematik
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik
open_access (DINI-Set):open_access
Licence (German):License LogoStandardbedingung laut Einverständniserklärung