The HTTP origin header that was proposed as a defense to CSRF attack has now been submitted for review to the IETF. Here is an interesting criticism to the proposed method in the IETF discussion forum:
http://lists.w3.org/Archives/Public/ietf-http-wg/2009JanMar/0037.html
Hi,
I am Himanshu Sharma and will be presenting this paper in class on Monday 03/02.
Purpose of the paper: Questioning and Detection of webpage integrity on the way from server to client browser, by using Web tripwires.
Web Tripwires: Client side JavaScript code that detects any change in the HTML Source Code.
It addresses the following issues:
- Why we need web tripwires.
- Who can cause the changes to web pages in transit.
- Purpose behind those changes.
- Bugs/ Vulnerabilities generated because of the changes
The paper proposes 5 web tripwire designs based on JavaScript with their pros and cons. It also compares the costs associated between tripwires and HTTPS.
The researchers have also published an open source toolkit for publishers to use with their websites, with the ability to make certain policy decisions. It uses the best of the 5 techniques implemented by the researchers - ” XHR on Self”.
The paper’s language is easy and descriptive and i hope the discussion on Monday will be beneficial for all in understanding it.
A critical buffer overflow vulnerability has been found in Adobe reader versions and acrobat professional.
Here is the link from Adobe
http://www.adobe.com/support/security/advisories/apsa09-01.html
The patch will be made available by march 18th. Enough time for the vulnerability to be expolited effectively ? (Given the percentage of users who use pdf files )
http://bits.blogs.nytimes.com/2009/02/24/viddyho-phishing-scam-hits-gmail/
This happened with me today!
I received a offline message from my friend who is on my chat list. It was suspicious since it as a “tinyurl” and I did click on it! [i know! 
]
Anyways, the site alerted me that it was a malicious content and hence I can view it at my risk, and I did not continue.
Hi all,
I am karthik and I will be presenting the paper “SpyProxy: Execution-based Detection of Malicious Web Content” on Wednesday, Feb 25,2009. This paper explores the use of execution-based Web content analysis to protect users from Internet-borne malware. Many anti-malware tools use signatures to identify malware infections on a user’s PC. In contrast, the authors approach is to render and observe active Web content in a disposable virtual machine before it reaches the user’s browser, identifying and blocking pages whose behavior is suspicious. Execution-based analysis can defend against undiscovered threats and zero-day attacks. However, it cannot identify cross site scripting and the authors approach faces challenges, such as achieving good interactive performance, and limitations, such as defending against malicious Web content that contains non-determinism.
Hi all,
I’m having a good time going through your reviews and have particularly enjoyed some of your reviews, comments and ideas. I realized that I don’t retain a copy of your essay once I return the graded copy to you.
Could you please submit your past essays by email attachment to i594a at cs ? PDF will be appreciated. (note the ‘a’ in the email address). If you had submitted handwritten reviews, you need not submit, but in future try to submit a typeset copy. For the email subject, use the short title of the paper as it appears (in square brackets) in the schedule. For instance, your email for the third paper in the list will have the subject “Re: Doppleganger”.
Note that I still require you to submit the reviews on paper in class for grading purposes.
Hi all. Am Guru. I will be presenting the paper on “A Safety-Oriented Platform forWeb Applications” here we will be concentrating on ‘Tahoma web browser’
We will go through the Tahoma Browser architecture and discuss how secure this browser is and also the pros and cons of this architecture. Tahoma architecture is based on the concept of users expectation of having a browser behave and be trustworthy like a real OS running on your PC.
Tahoma incorporates the following
- Isolates Web Applications
- Isolates Web browsers from the host operating system
Tahoma uses
- Xen Virtual machine on Linux OS
- Konqueror Web Browser
Here are some useful links for further reading.
http://en.wikipedia.org/wiki/Xen
http://en.wikipedia.org/wiki/Konqueror
http://www.cl.cam.ac.uk/research/srg/netos/xen/
http://www.vmware.com/pdf/asplos235_adams.pdf
Also this is a linkt to paper published by microsoft which critics the OP webbroswer, Chrome and Tahoma which uses ‘Browser Kernel’ as basic browser design and proposes a new browser called ‘Gazelle’. It was real fun to read.
http://research.microsoft.com/pubs/79655/gazelle.pdf
Thanks.
Gazelle is a new concept browser from Microsoft. I found this paper interesting, given the fact we just analyzed Doppelganger, OP and Chromium, with Tahoma on the horizon. You can find the paper here: http://research.microsoft.com/pubs/79655/gazelle.pdf.
Hi,
I am Kalpana Gondi, and I will be discussing the paper on “The Security Architecture of the Chromium Browser” on Wednesday, Feb 18,2009. The paper discusses the design of Google’s chrome browser from the security perspective. It is interesting to know that, chrome browser grabbed 3% share of the market within a month of its release in Sep 2008.
Chrome browser also uses a modular approach similar to OP browser (discussed in the last class). The key design goal for this browser is to prevent execution of arbitrary code in the browser code base (through exploitation of unpatched / zero day vulnerabilities). Threat model doesn’t cover – phishing, web site vulnerabilities (XSS, XSRF). As there is a production quality browser available, it seems more stable than OP.
Through sandboxing most browser code, and controlling access to OS resources, Chrome browser seems to reasonably achieve the design goals and can avoid -
Google chrome browser consists of two modules -
Rendering Engine is run in a sandbox which limits attackers’ abilities to compromise the user system. You can get more details about the sandbox design followed by google chrome at (mentioned in the references) http://dev.chromium.org/developers/design-documents/sandbox.
We will discuss in detail the architecture given in the paper and the security implications of the same. Also, a discussion on what security aspects to look for in browsers would be fruitful.
A document that sketches the class project requirements (along with some ideas for projects) has been mailed to everyone. If you have not received it, check your SPAM folder.