Paper Info
Title
You are what you include: large-scale evaluation of remote javascript inclusions
Abstract
JavaScript is used by web developers to enhance the interactivity of their sites, offload work to the users' browsers and improve their sites' responsiveness and user-friendliness, making web pages feel and behave like traditional desktop applications. An important feature of JavaScript, is the ability to combine multiple libraries from local and remote sources into the same page, under the same namespace. While this enables the creation of more advanced web applications, it also allows for a malicious JavaScript provider to steal data from other scripts and from the page itself. Today, when developers include remote JavaScript libraries, they trust that the remote providers will not abuse the power bestowed upon them. In this paper, we report on a large-scale crawl of more than three million pages of the top 10,000 Alexa sites, and identify the trust relationships of these sites with their library providers. We show the evolution of JavaScript inclusions over time and develop a set of metrics in order to assess the maintenance-quality of each JavaScript provider, showing that in some cases, top Internet sites trust remote providers that could be successfully compromised by determined attackers and subsequently serve malicious JavaScript. In this process, we identify four, previously unknown, types of vulnerabilities that attackers could use to attack popular web sites. Lastly, we review some proposed ways of protecting a web application from malicious remote scripts and show that some of them may not be as effective as previously thought.
Year
DOI
Venue
2012
10.1145/2382196.2382274
ACM Conference on Computer and Communications Security
Keywords
Field
DocType
javascript inclusion,malicious javascript provider,advanced web application,remote source,remote provider,remote javascript library,large-scale evaluation,malicious javascript,malicious remote script,javascript provider,remote javascript inclusion,popular web site,javascript,trust
Interactivity,World Wide Web,Internet privacy,Web page,Computer science,Computer security,Unobtrusive JavaScript,Web application,Dynamic web page,Rich Internet application,JavaScript,Scripting language
Conference
Citations 
PageRank 
References 
66
2.40
20
Authors
8
Name
Order
Citations
PageRank
Nick Nikiforakis186553.35
Luca Invernizzi227514.27
Alexandros Kapravelos332420.58
Steven Van Acker422711.60
Wouter Joosen52898287.70
Christopher Kruegel68799516.05
Frank Piessens72455162.28
Giovanni Vigna87121507.72