Year: 2019
Type: conference-paper
Abstract: The proliferation of web applications has essentially transformed modern browsers into small but powerful operating systems.Upon visiting a website, user devices run implicitly trusted script code, the execution of which is confined within the browser to prevent any interference with the user's system.Recent JavaScript APIs, however, provide advanced capabilities that not only enable feature-rich web applications, but also allow attackers to perform malicious operations despite the confined nature of JavaScript code execution.In this paper, we demonstrate the powerful capabilities that modern browser APIs provide to attackers by presenting MarioNet: a framework that allows a remote malicious entity to control a visitor's browser and abuse its resources for unwanted computation or harmful operations, such as cryptocurrency mining, password-cracking, and DDoS.MarioNet relies solely on already available HTML5 APIs, without requiring the installation of any additional software.In contrast to previous browserbased botnets, the persistence and stealthiness characteristics of MarioNet allow the malicious computations to continue in the background of the browser even after the user closes the window or tab of the initially visited malicious website.We present the design, implementation, and evaluation of our prototype system, which is compatible with all major browsers, and discuss potential defense strategies to counter the threat of such persistent inbrowser attacks.Our main goal is to raise awareness about this new class of attacks, and inform the design of future browser APIs so that they provide a more secure client-side environment for web applications.
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
Awards: THREAT-ARREST Cyber Security Threats and Threat Actors Training - Assurance Driven Multi-Layer, end-to-end Simulation and Training, G434337789, Enhancing Critical Infrastructure Protection with innovative SECurity framework, Restoring Trust in the cyber space: a Systems Security Proposal, REactively Defending against Advanced Cybersecurity Threats, TWC: Small: Combating Environment-aware Malware, Protecting Small and Medium-sized Enterprises digital technology through an innovative cyber-SECurity framework
OpenAlex ID: W2893936826