Toreini, Ehsan, Mehrnezhad, Maryam, Shahandashti, Siamak F. orcid.org/0000-0002-5284-6847 et al. (1 more author) (2019) DOMtegrity: Ensuring Web Page Integrity against Malicious Browser Extensions. International Journal of Information Security. pp. 1-14. ISSN 1615-5262
Abstract
In this paper, we address an unsolved problem in the real world: how to ensure the integrity of the web content in a browser in the presence of malicious browser extensions? The problem of exposing confidential user credentials to malicious extensions has been widely understood, which has prompted major banks to deploy two-factor authentication. However, the importance of the `integrity' of the web content has received little attention. We implement two attacks on real-world online banking websites and show that ignoring the `integrity' of the web content can fundamentally defeat two-factor solutions. To address this problem, we propose a cryptographic protocol called DOMtegrity to ensure the end-to-end integrity of the DOM structure of a web page from delivering at a web server to the rendering of the page in the user's browser. DOMtegrity is the first solution that protects DOM integrity without modifying the browser architecture or requiring extra hardware. It works by exploiting subtle yet important differences between browser extensions and in-line JavaScript code. We show how DOMtegrity prevents the earlier attacks and a whole range of man-in-the-browser (MITB) attacks. We conduct extensive experiments on more than 14,000 real-world extensions to evaluate the effectiveness of DOMtegrity.
Metadata
Item Type: | Article |
---|---|
Authors/Creators: |
|
Copyright, Publisher and Additional Information: | © The Author(s) 2019 |
Keywords: | web security,integrity,browser extension,Network Security,man-in-the-browser,MITB |
Dates: |
|
Institution: | The University of York |
Academic Units: | The University of York > Faculty of Sciences (York) > Computer Science (York) |
Depositing User: | Pure (York) |
Date Deposited: | 11 Jun 2019 11:20 |
Last Modified: | 25 Nov 2024 00:32 |
Published Version: | https://doi.org/10.1007/s10207-019-00442-1 |
Status: | Published online |
Refereed: | Yes |
Identification Number: | 10.1007/s10207-019-00442-1 |
Related URLs: | |
Open Archives Initiative ID (OAI ID): | oai:eprints.whiterose.ac.uk:147133 |
Download
Filename: Toreini2019_Article_DOMtegrityEnsuringWebPageInteg.pdf
Description: Toreini2019_Article_DOMtegrityEnsuringWebPageInteg
Licence: CC-BY 2.5