JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Michael Schwarz, Moritz Lipp, Daniel Gruss

Publikation: Beitrag in Buch/Bericht/KonferenzbandBeitrag in einem KonferenzbandBegutachtung

Abstract

Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but   they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.

We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript  language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical  solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.
Originalspracheenglisch
TitelNetwork and Distributed System Security Symposium 2018
Seiten15
PublikationsstatusVeröffentlicht - 18 Feb. 2018
VeranstaltungNetwork and Distributed System Security Symposium 2018 - Catamaran Resort Hotel and Spa, San Diego, USA / Vereinigte Staaten
Dauer: 18 Feb. 201821 Feb. 2018
https://www.ndss-symposium.org/ndss2018

Konferenz

KonferenzNetwork and Distributed System Security Symposium 2018
KurztitelNDSS'18
Land/GebietUSA / Vereinigte Staaten
OrtSan Diego
Zeitraum18/02/1821/02/18
Internetadresse

Fingerprint

Untersuchen Sie die Forschungsthemen von „JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks“. Zusammen bilden sie einen einzigartigen Fingerprint.

Dieses zitieren