5 ms·

I wonder if it would be possible to make a browser extension that rather than block all ads, would simply run all third-party scripts through something like thi

by Osiris 10y ago

I wonder if it would be possible to make a browser extension that rather than block all ads, would simply run all third-party scripts through something like this to disallow malicious behavior.

tscs37 10y ago
Forget it. That would include solving the halting problem by proxy. You can't know if a script or program is going to be malicious without effectively executing it. It's almost impossible. Just look at Anti-Virus, they've been trying forever and the best we have is research papers on immune-system-based AVs or AI-solutions.
- Osiris 10y ago
  You would be executing it within the sandbox, so even if there was malicious code, the ADsafe code wouldn't allow it to run certain parts of the code. You wouldn't have to know ahead of time it anything was bad.
  - tscs37 10y ago
    That would work but only if the sandbox is perfect. If the sandbox is leaky in either direction, the code can behave malicious again. As some research showed, even if your sandbox is absolutely perfect, you can break out using memory corruption through cosmic rays (no kidding) https://www.cs.princeton.edu/~appel/papers/memerr.pdf https://www.cs.princeton.edu/~appel/papers/memerr.pdf So to almost 100% protect against malicious javascript code we would have to: 1) Create a JS subset that is verifiably safe 2) Create a Sandbox for that JS subset that is verifiably safe 3) Ensure the Sandbox cannot leak data, which is going to be hard since it's probably going to interact with the user in some way 4) Have the consumer run ECC memory to reduce the chance of Sandbox-Leakage
- adrianN 10y ago
  The halting problem only applies if you want to be always right. If it is ok to sometimes reject scripts that are not malicious, the problem might still be hard, but it is not impossible.
  - tscs37 10y ago
    Heuristic is nice but I'm not aware of an AV that has no false-negatives, no matter how good the Heuristic is. If you ever think about "could we just block bad stuff?" then look at AVs and see if they can do it. AVs have probably the highest amount of research to ensure they catch as much as possible but it still does not work.
- alkonaut 10y ago
  Wait, I thought this was intentionally made a small enough subset that it should be not only possible but fast and simple to decide whether a chunk of code conforms or not? Is JavaScript so hard to parse and analyze that this is impossible?
  - tscs37 10y ago
    It's a generic problem in computing. Reducing the language set only changes the difficulty and does not eliminate it simply by the Nature of Turing machines.
    - roywiggins 10y ago
      Running a Turing-complete language in a jail is entirely possible. If you don't give it access to, say, webcam APIs the you can be sure it won't turn the webcam on unless there's a bug in the jail. Of course, proving the jail is secure is awfully difficult but you can at least analyze it at your leisure, and you only have to do it once. I don't know if this is possible as a practical matter but the halting problem doesn't exclude the possibility.
      - tscs37 10y ago
        I'm not aware of any perfect jail. Even then studies have shown that a simple memory error can lead to breakout.
        alkonaut 10y ago
        We already hope that the Turing Complete normal js doesn't access our files - so hopefully what this aims to do is simpler
    - alkonaut 10y ago
      Just because a language is turing complete doesnt't mean it can do anything. It might still have a limited api or run in a sandbox without access to the data we wish to protect. JS is already turing complete but we are pretty sure websites don't upload our local files to strangers) short of using vulnerabilities). I don't understand how it would be hard to invent a subset of JS small enough to be possible to validate.
- TeMPOraL 10y ago
  Moreover, "malicious" as commonly understood turns this into an AI-complete problem - whether or not a piece of code is "malicious" depends on things like intent and perspective of the person at the receiving end of code execution.
  - tscs37 10y ago
    Exactly. There are some people with more extreme opinons that label every ad as malicious while others (like me) will not label everything ad-like as malicious by default. Philosophical Issues makes complicate.
the8472 10y ago
If we assume that ads are loaded through <script> tags then a browser addon could rewrite those to exist within sandboxed iframes. The tricky part is only isolating the ads and not the functional parts of the website.
nickpsecurity 10y ago
Microsoft's Xax is closest thing to it. Such architectures could in theory be made for solving problems like we're discussing. They're applying it to plugins, esp reusing legacy code. https://www.usenix.org/legacy/event/osdi08/tech/full_papers/douceur/douceur_html/index.html https://www.usenix.org/legacy/event/osdi08/tech/full_papers/...

by Osiris 10y ago

I wonder if it would be possible to make a browser extension that rather than block all ads, would simply run all third-party scripts through something like this to disallow malicious behavior.

tscs37 10y ago

Forget it. That would include solving the halting problem by proxy. You can't know if a script or program is going to be malicious without effectively executing it. It's almost impossible. Just look at Anti-Virus, they've been trying forever and the best we have is research papers on immune-system-based AVs or AI-solutions.

Osiris 10y ago
You would be executing it within the sandbox, so even if there was malicious code, the ADsafe code wouldn't allow it to run certain parts of the code. You wouldn't have to know ahead of time it anything was bad.
- tscs37 10y ago
  That would work but only if the sandbox is perfect. If the sandbox is leaky in either direction, the code can behave malicious again. As some research showed, even if your sandbox is absolutely perfect, you can break out using memory corruption through cosmic rays (no kidding) https://www.cs.princeton.edu/~appel/papers/memerr.pdf https://www.cs.princeton.edu/~appel/papers/memerr.pdf So to almost 100% protect against malicious javascript code we would have to: 1) Create a JS subset that is verifiably safe 2) Create a Sandbox for that JS subset that is verifiably safe 3) Ensure the Sandbox cannot leak data, which is going to be hard since it's probably going to interact with the user in some way 4) Have the consumer run ECC memory to reduce the chance of Sandbox-Leakage
adrianN 10y ago
The halting problem only applies if you want to be always right. If it is ok to sometimes reject scripts that are not malicious, the problem might still be hard, but it is not impossible.
- tscs37 10y ago
  Heuristic is nice but I'm not aware of an AV that has no false-negatives, no matter how good the Heuristic is. If you ever think about "could we just block bad stuff?" then look at AVs and see if they can do it. AVs have probably the highest amount of research to ensure they catch as much as possible but it still does not work.
alkonaut 10y ago
Wait, I thought this was intentionally made a small enough subset that it should be not only possible but fast and simple to decide whether a chunk of code conforms or not? Is JavaScript so hard to parse and analyze that this is impossible?
- tscs37 10y ago
  It's a generic problem in computing. Reducing the language set only changes the difficulty and does not eliminate it simply by the Nature of Turing machines.
  - roywiggins 10y ago
    Running a Turing-complete language in a jail is entirely possible. If you don't give it access to, say, webcam APIs the you can be sure it won't turn the webcam on unless there's a bug in the jail. Of course, proving the jail is secure is awfully difficult but you can at least analyze it at your leisure, and you only have to do it once. I don't know if this is possible as a practical matter but the halting problem doesn't exclude the possibility.
    - tscs37 10y ago
      I'm not aware of any perfect jail. Even then studies have shown that a simple memory error can lead to breakout.
      - alkonaut 10y ago
        We already hope that the Turing Complete normal js doesn't access our files - so hopefully what this aims to do is simpler
  - alkonaut 10y ago
    Just because a language is turing complete doesnt't mean it can do anything. It might still have a limited api or run in a sandbox without access to the data we wish to protect. JS is already turing complete but we are pretty sure websites don't upload our local files to strangers) short of using vulnerabilities). I don't understand how it would be hard to invent a subset of JS small enough to be possible to validate.
TeMPOraL 10y ago
Moreover, "malicious" as commonly understood turns this into an AI-complete problem - whether or not a piece of code is "malicious" depends on things like intent and perspective of the person at the receiving end of code execution.
- tscs37 10y ago
  Exactly. There are some people with more extreme opinons that label every ad as malicious while others (like me) will not label everything ad-like as malicious by default. Philosophical Issues makes complicate.

the8472 10y ago

If we assume that ads are loaded through <script> tags then a browser addon could rewrite those to exist within sandboxed iframes. The tricky part is only isolating the ads and not the functional parts of the website.

nickpsecurity 10y ago

Microsoft's Xax is closest thing to it. Such architectures could in theory be made for solving problems like we're discussing. They're applying it to plugins, esp reusing legacy code. https://www.usenix.org/legacy/event/osdi08/tech/full_papers/douceur/douceur_html/index.html https://www.usenix.org/legacy/event/osdi08/tech/full_papers/...