Protecting User’s Privacy from Browser-Based Attacks

Abstract:

Recently there has been a new kind of attacks, browser-based attacks, against anonymous communication systems, such as Tor. This kind of attacks exploits JavaScript in the browser or the HTML meta refresh to generate some predefined signals to correlate users and their visited websites. A novel and efficient defense against such attacks is proposed in this paper. Our main observation is that the attacker must generate enough signals from the client site (the browser) to correlate the user and the website while we can detect the attack at the client site. More specifically, when a user is browsing a specific website and a browser-based attack is in progress, the number of outgoing flows and the total byte counts generated by the browser should be much larger compared with the normal browsing behavior. So we can set up fingerprints (number of outgoing flows and total byte counts) for normal browsing of web pages for a period of time and utilize these fingerprints to detect browser-based attacks. We have also found that some JavaScript codes must be executed many times if the attacker uses JavaScript to communicate. We have modified the Mozilla Firefox JavaScript engine to audit execution times of JavaScript code to defend these attacks, including browser-based attacks.

• Periodical: Applied Mechanics and Materials (Volumes 631-632)
• Pages: 941-945
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.631-632.941
• Online since: September 2014
• Authors: Gao Feng He*, Tao Zhang, Yuan Yuan Ma, Jia Xuan Fei
• Keywords: Anonymous Communication, Browser-Based Attacks, JavaScript, TOR

References

[1] D.L. Chaum, Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms, Communications of the ACM, vol. 24, 1981, p.422–426.

DOI: 10.1145/358549.358563

[2] R. Dingledine, N. Mathewson, and P. Syverson, Tor: The Second-Generation Onion Router, Proceedings of the 13th USENIX Security Symposium, San Diego, CA, USA, 2004, pp.21-38.

DOI: 10.21236/ada465464

[3] T.G. Abbott, K.I. Lai, M.R. Lieberman, and E.C. Price, Browser-Based Attacks on Tor, Proceedings of 7th Workshop on Privacy Enhancing Technologies, Springer Berlin, LNCS vol. 4776, 2007, pp.184-199.

DOI: 10.1007/978-3-540-75551-7_12

[4] X.G. Wang, J.Z. Luo, M. Yang and Z. Ling, A potential HTTP-based Application-level Attack against Tor, Future Generation Computer Systems, vol . 27, 2011, pp.67-77.

DOI: 10.1016/j.future.2010.04.007

[5] K.P. Dyer, S.E. Coull, T. Ristenpart and T. Shrimpton, Peek-a-boo, I Still See You: Why Efficient Traffic Analysis Countermeasures Fail, Proceedings of 2012 IEEE Symposium on Security and Privacy (S&P), Oakland, California, USA, 2012, pp.332-346.

DOI: 10.1109/sp.2012.28

[6] O. Hallaraker and G. Vigna, Detecting malicious JavaScript code in Mozilla, Proceedings of 10th IEEE International Conference on Engineering of Complex Computer Systems (ICECCS05), Shanghai, China, June 16-20, 2005, pp.85-94.

DOI: 10.1109/iceccs.2005.35