ABSTRACT
Modern web browsers now provide more customizations to improve the usability and their competitiveness. Browser extensions and private browsing mode (PBM) are arguably two most popular customizations. With billions of downloads, browser extensions enhance user experience by providing additional features. PBM enables users to browse the Internet while protecting their private browsing data. However, private data leakage threats still exist in browser extensions, even if under PBM.
In this dissertation, we first investigate two aspects of private data leakage threats associated with browser extensions: (1), aspect-level behavior clustering on browser extensions and its security implications, and (2), identifying privacy breaches caused by extensions under PBM.
First, many extensions can be downloaded from webstores without sufficient trust or safety scrutiny, which poses threats on user’s private data. In this dissertation, we propose an aspect-level behavior clustering approach to enhancing the safety management of extensions. We decompose an extension’s runtime behavior into several pieces, denoted as AEBs (Aspects of Extension Behavior). Similar AEBs of different extensions are grouped into an “AEB cluster” based on subgraph isomorphism. We then build profiles of AEB clusters for both extensions and categories (of extensions) to detect suspicious extensions.
Second, browser extensions can greatly undermine PBM, mostly due to the fact that browsers let extensions handle the private data themselves even if under PBM. We propose an approach to comprehensively identify and stop privacy breaches caused by browser extensions under PBM. We combine dynamic analysis and symbolic execution to represent extensions’ behavior. Our analysis shows that many extensions have not fulfilled PBM’s guidelines on handling private browsing data. The evaluation results on 1,912 Firefox extensions show that our approach can effectively identify and stop privacy breaches under PBM caused by extensions, with almost negligible performance impact.
Finally, we extend system-level behavior analysis on Android platform. We intend to map system level behavior with Android APIs, for further study to detect possible permission abusing.
Chapter 1
INTRODUCTION
Due to mainly the commercialization of the Internet and WWW, commodity web browsers nowadays all provide added features and rich services through customizations for individual users. Among those customizations, browser extensions are one of the most popular and important means developed by third-party vendors/developers. Such extensions can enrich user experience and GUI of web browsers and provide additional functionality. Extensions are pervasively supported by commodity web browsers, such as Mozilla Firefox, Google Chrome, and Internet Explorer. However, browser extensions are often criticized due to the fact that they have a relatively high privilege than other programs. Most commodity web browsers usually do not control how extensions handle personal data. Hence, there is a potential risk that extensions may leak or even steal personal information to third parties. In this dissertation, we investigate potential private data leakage threats associated with browser extensions.
Although most webstores have adopted a review process, security management is still unsystematic [1] . Many extensions can be downloaded from webstores without sufficient trust or safety scrutiny, which keeps users from differentiating benign extensions from malicious ones.
Another popular customization is private browsing. Modern commodity web browsers have gradually supported private browsing mode (PBM) for the sake of user’s privacy. The functionality and implementation of private browsing mode is becoming finer-grained; however, issues still exist, especially for browser extensions. They can easily breach the PBM, mostly due to the fact that modern browsers let extensions handle the private data themselves whether under private browsing mode or normal browsing mode. Although there are some preliminary studies on extensions’ compliance with private browsing mode, a systematic approach has not been proposed to automate the process, nor were any feasible measures to enhance the private browsing mode in real-world browsers.
To address the potential private data leakage threats with browser extensions, we propose an approach to system level behavior analysis. The key idea of system level behavior analysis is to get the runtime behaviors represented in system calls. Other intermediate behavior representations can then be extracted from system calls. System calls are the only interface between OS and a program, providing the only way for a program to access the OS services. Therefore, system level behavior analysis has advantages over other approaches, such as static analysis.
Besides the private data leakage threats on web browser extensions, system level behavior analysis can also be extended to other similar problems and applications.
In this dissertation, we propose to employ the system level behavior analysis on
Android applications. There are two primary reasons that we extend our research on Android applications. First, Android OS is now in a dominating position in mobile phones [2] , with more than one million applications and 50 billion downloads in Google Play [3] . Second, of all mobile malware, unfortunately, over 90% are found targeted on Android [4] .
1.1 PROBLEMS AND MOTIVATIONS
1.1.1 ASPECT-LEVEL BEHAVIOR CLUSTERING ON BROWSER EXTENSIONS
Commodity web browsers usually provide added features and rich services through customizations for individual users. Among those customizations, extensions are one of the most popular and important third-party applications. Such extensions can enhance user experience and GUI of web browsers and provide additional functionality. Extensions are widely supported by commodity web browsers, such as Mozilla Firefox, Google Chrome, and Internet Explorer. With thousands of extensions, Firefox add-ons are the most heavily used extensions. It is reported that 85% of Firefox 4 users have installed an add-on, with “more than 2.5 billion downloads and 580 million add-ons in use every day in Firefox 4 alone” [5] .
To support the enhanced functionality, commodity web browsers usually grant the “guest” extensions with full or similar privileges as granted to the “host” browsers [6] . This entails that they can get access to a user’s credentials, sensitive zone of the browser, and even the operating system resources. Thus, there is a potential risk that malicious extensions may leak or even steal personal information to third parties. One example of the notorious extensions is known as FirestarterFox, which hijacks all search requests and forwards them to a third party web site [7] . Even if the extensions are benign, they could still be exploited by attackers to gain access to sensitive information. In addition, there is a review process before developers publish their extensions; however, neither the automated review process in Chrome (in most cases) [8] , nor the manual review process by AMO editors in Firefox [9] provide a sufficient security scrutiny for extensions. This results in one of the most severe web security problems: how does one enjoy the benefits of extensions without suffering from the potential security loss?
To address this problem, a variety of approaches have been proposed in the literature; however, existing approaches cannot provide a sufficient method to serve the security purpose. First, static analysis of information flow, such as
VEX [10,11] , do provide a comprehensive code analysis, particularly on some crucial
APIs. However, a fatal weakness exists for this approach. Browser extensions are primarily written in the dynamic scripting language of JavaScript. Some runtime actions cannot be determined unless executed. It is very likely that some malicious actions are triggered in runtime. Second, dynamic analysis of sensitive information access, such as Sabre [6] , can avoid the pitfalls of static analysis. Sabre monitors the JavaScript execution by tainting the JavaScript objects. However, dynamic analysis usually poses a great overhead to the browser. It also has an issue of the code coverage. Third, runtime access control is also proposed to specifically monitor XPCOM calls so that every time an extension accessing XPCOM is monitored and controlled by policies defined in the execution monitor. However, XPCOM level monitoring is too restrictive and can disable some useful and normal XPCOM
calls [6] .
1.1.2 IDENTIFYING POTENTIAL BREACH OF EXTENSIONS UNDER PRIVATE BROWSING MODE
Privacy is always a controversial issue in web browsers. Modern web browsers nowadays almost tend to be the de facto operating systems. They provide a customizable environment to run web applications, access personal information, managing login credentials, etc. Historically, web browsers store information such as your browsing history, form entries, passwords (if you have authorized), cookies, and web cache. Hence, it is always a privacy concern about the stored information. There is potential risk that those information might be provisioned to third-parties, or even published on the Internet. To partially address this privacy concern, recent commodity web browsers have provided a feature called privacy mode, or private browsing mode. Under this mode, the browser will not save any information about which sites and pages you have visited [12] .
So far, many versions of Firefox still cannot fully support this private browsing mode. The session sometimes does not delete the temporary files [13] . However, of those customizations, extensions pose the greatest threat to the private browsing mode. Many extensions are implemented to process data related to cookies, history pages, download list, etc. They can breach the private browsing mode and bring new private concerns. So how does the browser deal with this potential conflict and ensure that the extensions respect the user’s choice on the privacy mode? The worse thing is that “the Private Browsing mode does not magically handle what your extension does in saving browsing history data; that is the job of each extension” [14] .
The job of each extension? That is just where the contradiction lies. First, web browsers tend to provide a newly added feature of privacy mode to let users have the choice on their own privacy. However, an obvious observation is extensions can breach this mode easily without user’s awareness. Second, web browsers cannot disable extensions automatically under the private browsing mode. Third, web browsers do not have the ability to change the setting for the existing millions of extensions. Many extension authors have not added this feature in the code due to two reasons. a) A detailed tutorial has not been provided by web browsers; and b) many extension authors have not realized the existence of this feature.
Benjamin S. Lerner,et al. provide a static type system to analyze JavaScript extensions under private browsing mode. They did find some extensions breach the private browsing mode. However, they just did a case study on 12 extensions, hardly could their approach be proved effective. The scalability is also big challenge in their approach.
1.1.3 MAPPING SYSTEM-LEVEL BEHAVIOR ANALYSIS WITH ANDROID APIS
Recent years have seen a huge growth of smartphones. In the fourth quarter of 2011, smartphone sales outpaced PC sales for the first time ever, and it was not even close, reported by Canalys [15] . Another milestone for smartphones is that smartphone sales have surpassed those of feature phones in early 2013. “Smartphones accounted for 51.8 percent of mobile phone sales in the second quarter of 2013, resulting in smartphone sales surpassing feature phone sales for the first time” [16] . Google’s Android was reported to account for 81.0% of all smartphone shipments in the third quarter of 2013 (3Q13), reported by IDC [2] . In the near seen future, Android will continue to dominate the smartphone market [17] .
With more than one million apps and 50 billion downloads, Google Play now acts as the engine of the application economy [3] . Due to its open source feature, Android has attracted thousands of developers and third-party organizations. However, it has also drawn the attention of attackers and malicious apps. Lookout Mobile
Security has reported that mobile malware resulted in a loss of US $1 million in
2011 [18] . In 2012, security software company CheckPoint reported that there was a loss of US $50 million in western Europe [19] . Of those mobile malware, as expected, over 90% are found targeted on Android [4] . What is worse, Trend Micro reported that Android-based mobile malware have reached a milestone of 1 million [20] . A malicious app can harm the user’s mobile device in various ways. A Trojan malware can steal user’s data like contact list and email addresses, hijacking user’s device resources, and preventing user from performing some actions, etc. Spyware can stealthily collect data regarding user’s behaviors and send those data to a remote server [4] .
Android provides multiple security features to achieve the goal of protecting user data and system resources, and providing application isolation. Essentially, those features can be divided into two layers: system and kernel level security, and application level security [21,22] . System and kernel level security is provided and ensured primarily by the Linux kernel. Specifically, a new inter-process communication (IPC) mechanism is provided by kernel to ensure the security when different applications communicate with each other. These features contribute to the process isolation and application sandboxing. The application level security includes the android permission model, application signing and verification, etc.
Specifically, android permission model provides “additional finer-grained security features through a “permission” mechanism that enforces restrictions on specific operations that a particular process can perform, and per-URI permissions for granting ad-hoc access to specific pieces of data” [23] .
Many Android application abuse this permission system. To detect the overprivileged applications, current approaches usually use higher level detection, e.g. Android API auditing. This does work to some extent. However, Android applications not only use more and more undocumented APIs, but also tend to use their own libraries to evade the Android APIs. A primary reason is that those attacks via calling Android APIs will be detected by Android API auditing tools. For example, Z. Zhang et al. proposed a transplantation attack which could “spy on users without the Android API auditing being aware of it” [24] . Essentially, this transplantation attack takes out the code from the system_server or mediaserver process and builds its own library to avoid directly calling Android APIs.
1.2 CONTRIBUTIONS
1.2.1 ASPECT-LEVEL BEHAVIOR CLUSTERING ON BROWSER EXTENSIONS
To address the security issues associated with browser extensions, we propose aspect-level browser extension behavior clustering. System Call Dependence Graphs
(SCDGs) are used as a representation of behaviors for extensions. We then decompose an extension’s runtime behavior into several pieces, denoted as Aspects of Extension Behavior (AEBs). Similar AEBs of different extensions are grouped into an “AEB cluster” based on subgraph isomorphism. We then build profiles of AEB clusters for both extensions and categories (of extensions) to detect suspicious extensions.
Though this work is not the first to apply behavior clustering in the security field [25,26] , this is still the first attempt to employ it into detecting suspicious browser extensions, which is a rather different story with others. Overall, this work makes the following contributions:
- To the best of our knowledge, this is the first study to cluster web browser extensions based on Operating System level runtime behaviors.
- This is the first attempt to apply symbolic execution into the study of web browser extensions. By increasing the input space coverage, the detection rate of suspicious extensions is greatly improved.
- We introduced new methods to address the differentiating of system call traces between the “host” browser and extensions. This greatly improves the accuracy of clustering and detection results.
- We dramatically increased the scale of dynamic analysis of browser extensions from around 20 (extensions per study) in the literature [1,6,27,28] to more than 1,000 extensions in our study. Although static analysis [10,11] of over
1,000 extensions can be done in a rather efficient way, dynamic analysis of over 1,000 extensions is a totally different “story”: due to the daunting difficulty of making dynamic analysis efficient and scalable [6,27,28] .
- We evaluate our approach atop the Mozilla Firefox browser. The experimental results using a large amount of training and testing dataset extensions show that our approach can effectively and efficiently cluster the existing extensions and detect suspicious ones.
1.2.2 IDENTIFYING POTENTIAL BREACH OF EXTENSIONS UNDER PRIVATE BROWSING MODE
Browser extensions can breach the private browsing mode, due to the fact that modern browsers let extensions handle the private data themselves whether under private browsing mode or normal browsing mode. Although there are some preliminary study on extensions’ compliance with private browsing mode, a systematic approach has not been proposed to automate the process, nor were any feasible measures to enhance the private browsing mode in real-world browsers. We identify an extension compliance with private browsing mode in two aspects: code checking for private browsing mode in its code and running state checking under private browsing mode. Static analysis and dynamic analysis are employed to address the issues in these two aspects, respectively.
Overall, this work makes the following contributions:
- To the best of our knowledge, this is first attempt to systematically define an extension’s compliance with private browsing mode: code checking for private browsing mode and running state checking under private browsing mode.
- We build an automated system to examine an extension’s code on checking for private browsing mode and to check an extension’s running state under private browsing mode, using static analysis and dynamic analysis, respectively.
- Our approach identifies a large amount of extensions breaching the private browsing mode whether in code checking or running state checking under private browsing mode.
- We propose some measures to improve and strengthen private browsing mode for different commodity browsers in both code checking and running state checking under private browsing mode.
1.2.3 MAPPING SYSTEM-LEVEL BEHAVIOR WITH ANDROID APIS
We employ system-level behavior analysis on Android applications. Though this work is not the first to apply system level behavior analysis on Android applications [29–33] , this is by far the first attempt to map system level behaviors with Android APIs. Our goal in this chapter is not to thoroughly detect malicious applications which evaded Android APIs. Instead, we intend to build a connection and finally a mapping between permissions an application declares and the invoked system level behaviors. This is a basis for further study on detecting possible malicious applications. Overall, this work makes the following contributions:
- We systematically employ system level behavior tracking on Android applications. Their behavior are dynamically represented by SCDGs.
- To the best of our knowledge, this is the first attempt to map system level behavior of Android application with Android APIs.
- The mapping between system calls and Android APIs can be further used to detected malicious applications which try to evade using Android APIs to conduct malicious actions.
1.3 OUTLINE
The rest of this dissertation is organized as follows. Chapter 2 presents our approach of aspect-level behavior clustering on browser extensions and its security implications. Chapter 3 proposes our approach to identify potential breach of extensions under private browsing mode. Chapter 4 proposes our approach of mapping system-level behavior with Android APIs. Finally, Chapter 6 summarizes the dissertation and conclude it.
Chapter 2 is organized as follows. Section 2.2 presents some background knowledge about extensions and different browser extension systems. Section 2.3 presents the problems associated with browser extensions. Section 2.4 discuss the problem statement and behavior representation. In Section 2.5, we propose behavior clustering based on graph/subgraph isomorphism of system call dependence graphs, primarily focusing on how we handle four challenges. We briefly shed light on our implementation in Section 2.5, followed by a comprehensive evaluation of our approach in Section 2.7. We then discuss some limitations and possible counterattacks in Section 2.8. Finally, we summarize the related work and draw a conclusion in Section 2.9 and Section 2.10, respectively.
Chapter 3 is organized as follows. Section 3.1 provides an introduction and background knowledge on our approach of identifying potential breach of extensions under private browsing mode. In Section 3.2, issues under private browsing mode with extensions and the problem statement of this chapter are presented. In Section 3.3, we propose our approach of static analysis and dynamic analysis. Measures to enhance private browsing mode are also proposed in this section. Experiment results are presented in Section 3.4. Finally, we summarize the related work and draw a conclusion in Section 3.5 and Section 3.6, respectively.
Chapter 4 is organized as follows. Section 4.1 provides an introduction about our approach and the current development of Android. Section 4.2 first gives some background knowledge on Android system. In Section 4.3, issues associated with Android applications are presented. We also present the problem statement of this chapter in this section. In Section 4.4, we propose our approach of mapping system-level behavior with Android APIs. We then evaluate our approach using a case study in Section 4.5. We discuss some limitations and future work of our approach in Section 4.6. Finally, we summarize the related work and draw a conclusion in Section 4.7 and Section 4.8, respectively.
Chapter 5 draws a conclusion of this dissertation.
IDENTIFYING PRIVATE DATA LEAKAGE THREATS IN WEB BROWSERS