Communications - June 2009

can inject malicious content into the HTTP response, simulating a reply from attacker.com.

2. 2. Gadget attacker

A gadget attacker is a Web attacker with one additional ability: the integrator embeds a gadget of the attacker’s choice. This assumption lets us accurately evaluate mashup isolation and communication protocols because the purpose of these protocols is to let an integrator embed untrusted gadgets safely. In practice, a gadget attacker can either wait for the user to visit the integrator or can redirect the user to the integrator’s Web site from attacker.com.

3. fRame isOLatiOn

Web sites can use frames to delegate portions of their screen real estate to other Web sites. For example, a site can sell parts of their pages to adverting networks. The browser displays the location of the main, or top-level, frame in its location bar. Subframes are often visually indistinguishable from other parts of a page, and the browser does not display their location in its user interface.

3. 1. Background

The browser’s scripting policy answers the question “when can one frame manipulate the contents of another frame?” The scripting policy is the most important part of the browser security policy because a frame can act on behalf of every other frame it can script. For example,

even if it contains content from another origin. There are a number of idioms for navigating frames, including

window.open(“ https://attacker.com/”, “frameName”);

which navigates a frame named frameName. Frame names exist in a global name space that is shared across origins.

3. 2. Cross-window attacks

In 1999, Georgi Guninski discovered that the permissive frame navigation policy admits serious attacks. ⁷ At the time, the password field on the CitiBank login page was contained within a frame, and the Web attacker could navigate that frame to https://attacker.com/, letting the attacker fill the frame with identical-looking content that steals the password. This cross-window attack proceeds as follows:

1. The user views a blog that displays the attacker’s ad.

2. Separately, the user visits bank.com, which displays its password field in a frame.

3. The advertisement navigates the password frame to https://attacker.com/. The location bar remains https://bank.com and the lock icon remains present.

4. The user enters his or her bank.com password into the https://attacker.com/ frame on the bank.com page, submitting the password to attacker.com.

otherWindow.document.forms[0]. password.value

attempts to read the user’s password from another window. Modern Web browsers let one frame read and write all the properties of another frame only when their content was retrieved from the same origin, i.e. when the scheme (e.g., http or https), host, and port of their locations match. If the content of other Window was retrieved from a different origin, the browser’s security policy will prevent the script above from accessing other Window. document.

In addition to enforcing the scripting policy, every bro wser must answer the question “when is one frame permitted to navigate another frame?” Prior to 1999, all Web browsers implemented a permissive policy:

Of the browsers in heavy use today, Internet Explorer 6 and Safari 3 both implement the permissive policy and allow this attack. Internet Explorer 7 and Firefox 2 implement stricter policies (described in subsequent sections). Many Web sites, including Google AdSense, display their password field in a frame and are vulnerable to this attack; see Figure 1.