Abstract
We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.
| Language | English |
|---|---|
| Title of host publication | Network and Distributed System Security Symposium 2018 |
| Pages | 15 |
| Status | Published - 18 Feb 2018 |
| Event | Network and Distributed System Security Symposium 2018 - Catamaran Resort Hotel and Spa, San Diego, United States Duration: 18 Feb 2018 → 21 Feb 2018 https://www.ndss-symposium.org/ndss2018 |
Conference
| Conference | Network and Distributed System Security Symposium 2018 |
|---|---|
| Abbreviated title | NDSS'18 |
| Country | United States |
| City | San Diego |
| Period | 18/02/18 → 21/02/18 |
| Internet address |
Fingerprint
Cite this
JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks. / Schwarz, Michael; Lipp, Moritz; Gruss, Daniel.
Network and Distributed System Security Symposium 2018. 2018. p. 15.Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
}
TY - GEN
T1 - JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks
AU - Schwarz,Michael
AU - Lipp,Moritz
AU - Gruss,Daniel
PY - 2018/2/18
Y1 - 2018/2/18
N2 - Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.
AB - Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.
M3 - Conference contribution
SP - 15
BT - Network and Distributed System Security Symposium 2018
ER -