JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but   they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.

We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript  language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical  solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.
LanguageEnglish
Title of host publicationNetwork and Distributed System Security Symposium 2018
Pages15
StatusPublished - 18 Feb 2018
EventNetwork and Distributed System Security Symposium 2018 - Catamaran Resort Hotel and Spa, San Diego, United States
Duration: 18 Feb 201821 Feb 2018
https://www.ndss-symposium.org/ndss2018

Conference

ConferenceNetwork and Distributed System Security Symposium 2018
Abbreviated titleNDSS'18
CountryUnited States
CitySan Diego
Period18/02/1821/02/18
Internet address

Fingerprint

Websites
Web browsers
World Wide Web
Interfaces (computer)
Hardware
Side channel attack
Industry

Cite this

Schwarz, M., Lipp, M., & Gruss, D. (2018). JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks. In Network and Distributed System Security Symposium 2018 (pp. 15)

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks. / Schwarz, Michael; Lipp, Moritz; Gruss, Daniel.

Network and Distributed System Security Symposium 2018. 2018. p. 15.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Schwarz, M, Lipp, M & Gruss, D 2018, JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks. in Network and Distributed System Security Symposium 2018. pp. 15, Network and Distributed System Security Symposium 2018, San Diego, United States, 18/02/18.
Schwarz M, Lipp M, Gruss D. JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks. In Network and Distributed System Security Symposium 2018. 2018. p. 15.
Schwarz, Michael ; Lipp, Moritz ; Gruss, Daniel. / JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks. Network and Distributed System Security Symposium 2018. 2018. pp. 15
@inproceedings{f3b555b55b8f401d99e371813ec22cd0,
title = "JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks",
abstract = "Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but   they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript  language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 {\%} of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82{\%} on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical  solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.",
author = "Michael Schwarz and Moritz Lipp and Daniel Gruss",
year = "2018",
month = "2",
day = "18",
language = "English",
pages = "15",
booktitle = "Network and Distributed System Security Symposium 2018",

}

TY - GEN

T1 - JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

AU - Schwarz,Michael

AU - Lipp,Moritz

AU - Gruss,Daniel

PY - 2018/2/18

Y1 - 2018/2/18

N2 - Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but   they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript  language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical  solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.

AB - Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but   they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript  language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical  solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.

M3 - Conference contribution

SP - 15

BT - Network and Distributed System Security Symposium 2018

ER -