NDLI: All Your Screens Are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API

Content Provider	IEEE Xplore Digital Library
Author	Yuan Tian Ying Chuan Liu Bhosale, A. Lin Shung Huang Tague, P. Jackson, C.
Copyright Year	2014
Abstract	HTML5 changes many aspects in the browser world by introducing numerous new concepts, in particular, the new HTML5 screen sharing API impacts the security implications of browsers tremendously. One of the core assumptions on which browser security is built is that there is no cross-origin feedback loop from the client to the server. However, the screen sharing API allows creating a cross-origin feedback loop. Consequently, websites will potentially be able to see all visible content from the user's screen, irrespective of its origin. This cross-origin feedback loop, when combined with human vision limitations, can introduce new vulnerabilities. An attacker can capture sensitive information from victim's screen using the new API without the consensus of the victim. We investigate the security implications of the screen sharing API and discuss how existing defenses against traditional web attacks fail during screen sharing. We show that several attacks are possible with the help of the screen sharing API: cross-site request forgery, history sniffing, and information stealing. We discuss how popular websites such as Amazon and Wells Fargo can be attacked using this API and demonstrate the consequences of the attacks such as economic losses, compromised account and information disclosure. The objective of this paper is to present the attacks using the screen sharing API, analyze the fundamental cause and motivate potential defenses to design a more secure screen sharing API.
Starting Page	34
Ending Page	48
File Size	1802555
Page Count	15
File Format	PDF
ISBN	9781479946860
ISSN	10816011
DOI	10.1109/SP.2014.10
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-05-18
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Browsers Security Receivers Servers History Feedback loop Google Screen Sharing HTML5 Browser Security
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

All Your Screens are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API

All your Google and Facebook logins are belong to us: A case for single sign-off

All your contacts are belong to us: automated identity theft attacks on social networks

All your cluster-grids are belong to us: Monitoring the (in)security of infrastructure monitoring systems

All Your Droid Are Belong To Us: A Survey of Current Android Attacks

All your contacts are belong to us: automated identity theft attacks on social networks.

All your browser-saved passwords could belong to us: a security analysis and a cloud-based new design

Www 2009 madrid! track: security and privacy / session: web security all your contacts are belong to us: automated identity theft attacks on social networks.

Kepler -- Raising Browser Security Awareness

All Your Screens Are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API

Similar Documents

All Your Screens are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API

All your Google and Facebook logins are belong to us: A case for single sign-off

All your contacts are belong to us: automated identity theft attacks on social networks

All your cluster-grids are belong to us: Monitoring the (in)security of infrastructure monitoring systems

All Your Droid Are Belong To Us: A Survey of Current Android Attacks

All your contacts are belong to us: automated identity theft attacks on social networks.

All your browser-saved passwords could belong to us: a security analysis and a cloud-based new design

Www 2009 madrid! track: security and privacy / session: web security all your contacts are belong to us: automated identity theft attacks on social networks.

Kepler -- Raising Browser Security Awareness

All Your Screens Are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API