NDLI: Security Signature Inference for JavaScript-based Browser Addons

Please wait, while we are loading the content...

Software Transactional Memory for GPU Architectures

Red Fox: An Execution Environment for Relational Query Processing on GPUs

Call Paths for Pin Tools

DeltaPath: Precise and Scalable Calling Context Encoding

Static Reference Analysis for GUI Objects in Android Software

Non-affine Extensions to Polyhedral Code Generation

Security Signature Inference for JavaScript-based Browser Addons

Adaptive Mapping and Parameter Selection Scheme to Improve Automatic Code Generation for GPUs

Warm-Up Simulation Methodology for HW/SW Co-Designed Processors

Just-In-Time Software Pipelining

Portable and Transparent Host-Device Communication Optimization for GPGPU Environments

LeakChecker: Practical Static Memory Leak Detection for Managed Languages

Dynamic and Adaptive Calling Context Encoding

Accelerating Dynamic Detection of Uses of Undefined Values with Static Value-Flow Analysis

Single Assignment Compiler, Single Assignment Architecture: Future Gated Single Assignment Form*; Static Single Assignment with Congruence Classes

Estimating the Empirical Cost Function of Routines with Dynamic Workloads

Fix the code. Don't tweak the hardware: A new compiler approach to Voltage-Frequency scaling

Optimizing R VM: Allocation Removal and Path Length Reduction via Interpreter-level Specialization

A Basic Linear Algebra Compiler

Hybrid Hexagonal/Classical Tiling for GPUs

DrDebug: Deterministic Replay based Cyclic Debugging with Dynamic Slicing

Fine-grained Benchmark Subsetting for System Selection

Partial Escape Analysis and Scalar Replacement for Java

Simplifying Scalable Graph Processing with a Domain-Specific Language

Automated Algorithmic Error Resilience for Structured Grid Problems Based on Outlier Detection

Fluidic Kernels: Cooperative Execution of OpenCL Programs on Multiple Heterogeneous Devices

Extending the PCRE Library with Static Backtracking Based Just-in-Time Compilation Support

Efficient Mapping of Irregular C++ Applications to Integrated GPUs

WatchdogLite: Hardware-Accelerated Compiler-Based Pointer Checking

Security Signature Inference for JavaScript-based Browser Addons

Content Provider	ACM Digital Library
Author	Hardekopf, Ben Kashyap, Vineeth
Abstract	JavaScript-based browser addons are a tempting target for malicious developers---addons have high privileges and ready access to a browser user's confidential information, and they have none of the usual sandboxing or other security restrictions used for client-side webpage JavaScript. Therefore, vetting third-party addons is important both for addon users and for the browser providers that host official addon repositories. The current state-of-the-art vetting methodology is manual and ad-hoc, which makes the vetting process difficult, tedious, and error-prone. In this paper, we propose a method to help automate this vetting process. We describe a novel notion of addon security signatures, which provide detailed information about an addon's information flows and API usage, along with a novel static analysis to automatically infer these signatures from the addon code. We implement our analysis and empirically evaluate it on a benchmark suite consisting of ten real browser addons taken from the official Mozilla addon repository. Our results show that our analysis is practical and useful for vetting browser addons.
Starting Page	219
Ending Page	229
Page Count	11
File Format	PDF
ISBN	9781450326704
DOI	10.1145/2544137.2544149
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-02-15
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Browser addons Static analysis Javascript
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

JSAI: A Static Analysis Platform for JavaScript

On evaluating and securing firefox for Android browser extensions

Protecting Web Browser Extensions from JavaScript Injection Attacks

GULFSTREAM: Staged Static Analysis for Streaming JavaScript Applications

JavaScript instrumentation for browser security

Dynamic Information Flow Analysis for JavaScript in a Web Browser

Insecure JavaScript Detection and Analysis with Browser-Enforced Embedded Rules

Analyzing Information Flow in JavaScript-Based Browser Extensions

Flow: Abstract Interpretation of JavaScript for Type Checking and Beyond

Security Signature Inference for JavaScript-based Browser Addons

Similar Documents

JSAI: A Static Analysis Platform for JavaScript

On evaluating and securing firefox for Android browser extensions

Protecting Web Browser Extensions from JavaScript Injection Attacks

GULFSTREAM: Staged Static Analysis for Streaming JavaScript Applications

JavaScript instrumentation for browser security

Dynamic Information Flow Analysis for JavaScript in a Web Browser

Insecure JavaScript Detection and Analysis with Browser-Enforced Embedded Rules

Analyzing Information Flow in JavaScript-Based Browser Extensions

Flow: Abstract Interpretation of JavaScript for Type Checking and Beyond

Security Signature Inference for JavaScript-based Browser Addons