Information Flow for Web Security and Privacy
Doktorsavhandling, 2020
The use of libraries is prevalent in modern web development. But how to ensure sensitive data is not being leaked through these libraries? This is the first challenge this thesis aims to solve. We propose the use of information-flow control by developing a principled approach to allow information-flow tracking in libraries, even if the libraries are written in a language not supporting information-flow control. The approach allows library functions to have unlabel and relabel models that explain how values are unlabeled and relabeled when marshaled between the labeled program and the unlabeled library. The approach handles primitive values and lists, records, higher-order functions, and references through the use of lazy marshaling.
Web pages can combine benign properties of a user's browser to a fingerprint, which can identify the user. Fingerprinting can be intrusive and often happens without the user's consent. The second challenge this thesis aims to solve is to bridge the gap between the principled approach of handling libraries, to practical use in the information-flow aware JavaScript interpreter JSFlow. We extend JSFlow to handle libraries and be deployed in a browser, enabling information-flow tracking on web pages to detect fingerprinting.
Modern browsers allow for browser modifications through browser extensions. These extensions can be intrusive by, e.g., blocking content or
modifying the DOM, and it can be in the interest of web pages to detect which extensions are installed in the browser. The third challenge this thesis aims to solve is finding which browser extensions are executing in a user's browser, and investigate how the installed browser extensions can be used to decrease the privacy of users. We do this by conducting several large-scale studies and show that due to added security by browser vendors, a web page may uniquely identify a user based on the installed browser extension alone.
It is popular to use filter lists to block unwanted content such as ads and tracking scripts on web pages. These filter lists are usually crowd-sourced and
mainly focus on English speaking regions. Non-English speaking regions should use a supplementary filter list, but smaller linguistic regions may not have an up to date filter list. The fourth challenge this thesis aims to solve is how to automatically generate supplementary filter lists for regions which currently do not have an up to date filter list.
Web pages can combine benign properties of a user's browser to a fingerprint, which can identify the user. Fingerprinting can be intrusive and often happens without the user's consent. The second challenge this thesis aims to solve is to bridge the gap between the principled approach of handling libraries, to practical use in the information-flow aware JavaScript interpreter JSFlow. We extend JSFlow to handle libraries and be deployed in a browser, enabling information-flow tracking on web pages to detect fingerprinting.
Modern browsers allow for browser modifications through browser extensions. These extensions can be intrusive by, e.g., blocking content or
modifying the DOM, and it can be in the interest of web pages to detect which extensions are installed in the browser. The third challenge this thesis aims to solve is finding which browser extensions are executing in a user's browser, and investigate how the installed browser extensions can be used to decrease the privacy of users. We do this by conducting several large-scale studies and show that due to added security by browser vendors, a web page may uniquely identify a user based on the installed browser extension alone.
It is popular to use filter lists to block unwanted content such as ads and tracking scripts on web pages. These filter lists are usually crowd-sourced and
mainly focus on English speaking regions. Non-English speaking regions should use a supplementary filter list, but smaller linguistic regions may not have an up to date filter list. The fourth challenge this thesis aims to solve is how to automatically generate supplementary filter lists for regions which currently do not have an up to date filter list.
browser extensions
side-effectful libraries
information-flow control
web security
filter list generation
browser fingerprinting
Online using Zoom
Opponent: Prof. Davide Balzarotti, Eurecom, Sophia Antipolis, France
Författare
Alexander Sjösten
Chalmers, Data- och informationsteknik, Informationssäkerhet
A Principled Approach to Tracking Information Flow in the Presence of Libraries
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics),; Vol. 10204(2017)p. 49-70
Paper i proceeding
Information Flow Tracking for Side-Effectful Libraries
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics),; Vol. 10854(2018)p. 141-160
Paper i proceeding
EssentialFP: Exposing the Essence of Browser Fingerprinting
Proceedings - 2021 IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2021,; (2021)p. 32-48
Paper i proceeding
Discovering Browser Extensions via Web Accessible Resources
CODASPY 2017 - Proceedings of the 7th ACM Conference on Data and Applications Security and Privacy,; (2017)p. 329-336
Paper i proceeding
Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks
Proceedings 2019 Network and Distributed System Security Symposium,; (2019)
Paper i proceeding
Filter List Generation for Underserved Regions
The Web Conference 2020 - Proceedings of the World Wide Web Conference, WWW 2020,; (2020)p. 1682-1692
Paper i proceeding
Over the last decades, the Internet has become a big factor in our daily lives allowing us to handle our bank transfers, do our shopping, read the news, watch movies, listen to music, and socialize with friends and family (almost) wherever we are through web applications. With more and more of our lives shifting online, we share private data both intentionally through for instance social networks and unintentionally by simply browsing the wrong web pages. This means seemingly free services are being paid for with our data, and we can be tracked based on this data which puts the user's privacy at risk.
There are many ways the security of an application and the user's privacy can be compromised. User credentials, such as the username and password, or credit card information can be stolen. But more subtly, different parties may want to track which web pages you visit to learn about your browsing behavior. The reasons can be to increase the user experience, but also to maximize profits through for instance ad revenue. This can be achieved by collecting information about the specific web browser and hardware you are currently using and combining these seemingly benign attributes into one identifier, known as a browser fingerprint. The common pattern in all of these cases is that private data is being leaked to public targets.
This thesis attempts to increase web security and privacy in three different ways. Firstly by labeling the data in an application as either private or
public, and then track how the information flows in the application to prevent the private data from being leaked to any public targets. Secondly by showing how installed browser extensions (applications one can install in the web browser) can be used by web pages to learn more information about a user, and how this can be prevented. Thirdly, the web security and privacy is increased by generating rules which would help block advertisements, as the entire process of showing ads can be privacy intrusive.
In short, the technologies presented in this thesis have the aim of increasing web security and privacy, which would lead to less private information being revealed about the users.
There are many ways the security of an application and the user's privacy can be compromised. User credentials, such as the username and password, or credit card information can be stolen. But more subtly, different parties may want to track which web pages you visit to learn about your browsing behavior. The reasons can be to increase the user experience, but also to maximize profits through for instance ad revenue. This can be achieved by collecting information about the specific web browser and hardware you are currently using and combining these seemingly benign attributes into one identifier, known as a browser fingerprint. The common pattern in all of these cases is that private data is being leaked to public targets.
This thesis attempts to increase web security and privacy in three different ways. Firstly by labeling the data in an application as either private or
public, and then track how the information flows in the application to prevent the private data from being leaked to any public targets. Secondly by showing how installed browser extensions (applications one can install in the web browser) can be used by web pages to learn more information about a user, and how this can be prevented. Thirdly, the web security and privacy is increased by generating rules which would help block advertisements, as the entire process of showing ads can be privacy intrusive.
In short, the technologies presented in this thesis have the aim of increasing web security and privacy, which would lead to less private information being revealed about the users.
Styrkeområden
Informations- och kommunikationsteknik
Ämneskategorier
Kommunikationssystem
Datavetenskap (datalogi)
ISBN
978-91-7905-348-2
Doktorsavhandlingar vid Chalmers tekniska högskola. Ny serie: 4815
Utgivare
Chalmers