usenix conference policies
Detecting In-Flight Page Changes with Web Tripwires
Error message
You are not authorized to post comments.Abstract:
While web pages sent over HTTP have no integrity guarantees, it is commonly assumed that such pages are not modified in transit. In this paper, we provide evidence of surprisingly widespread and diverse changes made to web pages between the server and client. Over 1% of web clients in our study received altered pages, and we show that these changes often have undesirable consequences for web publishers or end users. Such changes include popup blocking scripts inserted by client software, advertisements injected by ISPs, and even malicious code likely inserted by malware using ARP poisoning. Additionally, we find that changes introduced by client software can inadvertently cause harm, such as introducing cross-site scripting vulnerabilities into most pages a client visits. To help publishers understand and react appropriately to such changes, we introduce web tripwires—client-side JavaScript code that can detect most in-flight modifications to a web page. We discuss several web tripwire designs intended to provide basic integrity checks for web servers. We show that they are more flexible and less expensive than switching to HTTPS and do not require changes to current browsers.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
BibTeX
@inproceedings {268294,
author = {Charles Reis and Steven D. Gribble and Tadayoshi Kohno and Nicholas C. Weaver},
title = {Detecting {In-Flight} Page Changes with Web Tripwires},
booktitle = {5th USENIX Symposium on Networked Systems Design and Implementation (NSDI 08)},
year = {2008},
address = {San Francisco, CA},
url = {https://www.usenix.org/conference/nsdi-08/detecting-flight-page-changes-web-tripwires},
publisher = {USENIX Association},
month = apr
}
author = {Charles Reis and Steven D. Gribble and Tadayoshi Kohno and Nicholas C. Weaver},
title = {Detecting {In-Flight} Page Changes with Web Tripwires},
booktitle = {5th USENIX Symposium on Networked Systems Design and Implementation (NSDI 08)},
year = {2008},
address = {San Francisco, CA},
url = {https://www.usenix.org/conference/nsdi-08/detecting-flight-page-changes-web-tripwires},
publisher = {USENIX Association},
month = apr
}
connect with us