5 ms·

I believe that concerns like this are why Apple will introduce the "content blocking" extensions in iOS 9 and OS X 10.11. They enable the most popular types of

I believe that concerns like this are why Apple will introduce the "content blocking" extensions in iOS 9 and OS X 10.11. They enable the most popular types of extension (ad blocking and privacy protection) without letting extension code run in your browser. While the tainted data approach sounds interesting, I don't think there's an easy way to guarantee the safeness of arbitrary code executed on your machine. It's possible to sandbox code, but as soon as you allow any communication at all, there's no automated way to prevent data theft.

deian 11y ago
"I believe that concerns like this are why Apple will introduce the "content blocking" extensions in iOS 9 and OS X 10.11. They enable the most popular types of extension (ad blocking and privacy protection) without letting extension code run in your browser." Fully agree. We actually described exactly that mechanism in an early version of our paper (declarative APIs), but didn't have enough space to do it for the final version. "While the tainted data approach sounds interesting, I don't think there's an easy way to guarantee the safeness of arbitrary code executed on your machine. It's possible to sandbox code, but as soon as you allow any communication at all, there's no automated way to prevent data theft." It turns out, it is possible with information flow control (IFC). The simple idea behind IFC is to protect data by labeling/tagging it and restricting code according to the kinds of labeled data it reads. Once code in an execution context (e.g., iframe or process) reads some labeled data, IFC restricts where it can further communicate. In the simplest form: once you read data that is SECRET, you can't write to any PUBLIC communication channel. (You can, of course, write to a SECRET channel.)
moe 11y ago
but as soon as you allow any communication at all, there's no automated way to prevent data theft. I think you missed the point of the article, which proposes exactly that. All I/O functions would tag all variables populated by them with the source of the data. When a tagged ("tainted") variable is used in an I/O function again, we can compare origin/destination and apply firewall-style filtering or prompt the user. .----------------------------------------. | Add-On "Evernote" has read data from: | | Chrome Clipboard | | | | and wants to send it to: | | http://evernote.com | +----------------------------------------+ | [Deny] [Allow] ( ) Remember | `----------------------------------------'
- Perseids 11y ago
  Afaict, to not be unuseable restrictive, the extension has to at least have access to the originating site by default. Thus the security of the data depends on the originating site to be secure against leakage – a property no site is designed to accomplish. Just follow through with the first example of Gmail: An extension can write emails to arbitrary third parties (and erase it immediately after to cover its tracks) by using only the intentionally provided functionality of the site.
- ajuc 11y ago
  Will this show a warning? for (int i=0;i<LEN; i++) { for (char c=0; c<255;c++) { if (tainted[i] == c) { untainted[i] = c; } } } send(untainted); If no - protection doesn't work obviously. If yes - almost all variables are tainted (you don't usually read stuff that doesn't influence codepaths or global state in your application). In the promiscuous world of imperative programming there's millions of ways to introduce dependency that can't be automaticaly checked. For more complex - you can have workers/threads doing while() { sleep(), next_letter; } and other workers killing them after calculated time. Or you can get different number of pseudorandom numbers from generator with known seed in one loop depending on tainted data, and after the loop untainted data is set depending on the current random number from the same generator. Calling rand() taints the generator. I thought they would just mark the whole etension as tainted once it reads tainted data. And then any communication with other sites show the warning.
  - moe 11y ago
    Will this show a warning? Yes, because the assignment happens inside a conditional that references a tainted variable. In the promiscuous world of imperative programming there's millions of ways to introduce dependency that can't be automaticaly checked. That is not true. workers/threads doing while() { sleep(), next_letter; } What is that supposed to achieve? known seed in one loop depending on tainted data Every variable assigned to within a "loop depending on tainted data" becomes tainted. Calling rand() doesn't taint the generator. Seeding it within a tainted scope does. Edit: I was wrong (see below), of course rand() also taints the generator.

deian 11y ago

"I believe that concerns like this are why Apple will introduce the "content blocking" extensions in iOS 9 and OS X 10.11. They enable the most popular types of extension (ad blocking and privacy protection) without letting extension code run in your browser." Fully agree. We actually described exactly that mechanism in an early version of our paper (declarative APIs), but didn't have enough space to do it for the final version. "While the tainted data approach sounds interesting, I don't think there's an easy way to guarantee the safeness of arbitrary code executed on your machine. It's possible to sandbox code, but as soon as you allow any communication at all, there's no automated way to prevent data theft." It turns out, it is possible with information flow control (IFC). The simple idea behind IFC is to protect data by labeling/tagging it and restricting code according to the kinds of labeled data it reads. Once code in an execution context (e.g., iframe or process) reads some labeled data, IFC restricts where it can further communicate. In the simplest form: once you read data that is SECRET, you can't write to any PUBLIC communication channel. (You can, of course, write to a SECRET channel.)

moe 11y ago

but as soon as you allow any communication at all, there's no automated way to prevent data theft. I think you missed the point of the article, which proposes exactly that. All I/O functions would tag all variables populated by them with the source of the data. When a tagged ("tainted") variable is used in an I/O function again, we can compare origin/destination and apply firewall-style filtering or prompt the user. .----------------------------------------. | Add-On "Evernote" has read data from: | | Chrome Clipboard | | | | and wants to send it to: | | http://evernote.com | +----------------------------------------+ | [Deny] [Allow] ( ) Remember | `----------------------------------------'

Perseids 11y ago
Afaict, to not be unuseable restrictive, the extension has to at least have access to the originating site by default. Thus the security of the data depends on the originating site to be secure against leakage – a property no site is designed to accomplish. Just follow through with the first example of Gmail: An extension can write emails to arbitrary third parties (and erase it immediately after to cover its tracks) by using only the intentionally provided functionality of the site.
ajuc 11y ago
Will this show a warning? for (int i=0;i<LEN; i++) { for (char c=0; c<255;c++) { if (tainted[i] == c) { untainted[i] = c; } } } send(untainted); If no - protection doesn't work obviously. If yes - almost all variables are tainted (you don't usually read stuff that doesn't influence codepaths or global state in your application). In the promiscuous world of imperative programming there's millions of ways to introduce dependency that can't be automaticaly checked. For more complex - you can have workers/threads doing while() { sleep(), next_letter; } and other workers killing them after calculated time. Or you can get different number of pseudorandom numbers from generator with known seed in one loop depending on tainted data, and after the loop untainted data is set depending on the current random number from the same generator. Calling rand() taints the generator. I thought they would just mark the whole etension as tainted once it reads tainted data. And then any communication with other sites show the warning.
- moe 11y ago
  Will this show a warning? Yes, because the assignment happens inside a conditional that references a tainted variable. In the promiscuous world of imperative programming there's millions of ways to introduce dependency that can't be automaticaly checked. That is not true. workers/threads doing while() { sleep(), next_letter; } What is that supposed to achieve? known seed in one loop depending on tainted data Every variable assigned to within a "loop depending on tainted data" becomes tainted. Calling rand() doesn't taint the generator. Seeding it within a tainted scope does. Edit: I was wrong (see below), of course rand() also taints the generator.