Local Storage on Steroids: Abusing Web Browsers for Hidden Content Storage and Distribution

  • Analysing security assumptions taken for the WebRTC and postMessage APIs led us to find a novel attack abusing the browsers' persistent storage capabilities. The presented attack can be executed without the website's visitor knowledge, and it requires neither browser vulnerabilities nor additional software on the browser's side. To exemplify this, we study how can an attacker use browsers to create a network for persistent storage and distribution of arbitrary data. In our proof of concept, the total storage of the network, and therefore the space used within each browser, grows linearly with the number of origins delivering the malicious JavaScript code. Further, data transfers between browsers are not restricted by the Same Origin Policy, which allows for a unified cross-origin browser network, regardless of the origin from which the script executing the functionality is loaded from. In the course of our work, we assess the feasibility of a real-life deployment of the network by running experiments using Linux containersAnalysing security assumptions taken for the WebRTC and postMessage APIs led us to find a novel attack abusing the browsers' persistent storage capabilities. The presented attack can be executed without the website's visitor knowledge, and it requires neither browser vulnerabilities nor additional software on the browser's side. To exemplify this, we study how can an attacker use browsers to create a network for persistent storage and distribution of arbitrary data. In our proof of concept, the total storage of the network, and therefore the space used within each browser, grows linearly with the number of origins delivering the malicious JavaScript code. Further, data transfers between browsers are not restricted by the Same Origin Policy, which allows for a unified cross-origin browser network, regardless of the origin from which the script executing the functionality is loaded from. In the course of our work, we assess the feasibility of a real-life deployment of the network by running experiments using Linux containers and browser automation tools. Moreover, we show how security mechanisms against third-party tracking, cross-site scripting and click-jacking can diminish the attack's impact, or even prevent it.show moreshow less

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar
Metadaten
Author:Juan D. Parra Rodriguez, Joachim PoseggaORCiDGND
URN:urn:nbn:de:bvb:739-opus4-6572
DOI:https://doi.org/10.1007/978-3-030-01704-0_19
ISBN:978-3-030-01704-0
Parent Title (English):International Conference on Security and Privacy in Communication Systems
Publisher:Springer
Place of publication:Cham
Document Type:Conference Proceeding
Language:English
Year of Completion:2018
Date of Publication (online):2019/07/30
Date of first Publication:2018/12/29
Publishing Institution:Universität Passau
Release Date:2019/07/30
Tag:Browser Security; Web Security; WebRTC; postMessage
Page Number:20 Seiten
Institutes:Fakultät für Informatik und Mathematik
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 000 Informatik, Informationswissenschaft, allgemeine Werke
open_access (DINI-Set):open_access
Licence (German):License LogoStandardbedingung laut Einverständniserklärung