Implement functionality proposed in JavaScript Zero #39

PeetHornak · 2020-05-12T17:07:34Z

Paper: https://misc0110.net/web/files/jszero.pdf
Proof of concept: https://github.com/IAIK/ChromeZero
Fixes:

Now works on Chrome
Parse sub domains while setting level
Makefile works on MacOS

Functionality:

Slow WebWorkers messages
WebWorker polyfill, disables true parallelism
Slow SharedArrayBuffer messages
Disable SharedArrayBuffer
Wrap DataView and TypedArrays - randomly memory access, random mapping of indexes to memory, preloading in constructor,
Random noise in High resolution timestamps

Buffer ASLR was not implemented even though it was proposed in paper.

…roxy object so it can be detected using is_proxy Symbol

…ct to disable exploits of performance.mark()

…eads to error.

polcak · 2020-05-13T06:19:48Z

409f3dd split into d880889 and aa523a1. Pushed and fixed #35

See also #39 and commit e0c1142

polcak · 2020-05-13T06:41:15Z

Can 70199a9 replace e0c1142?

Note that neither 70199a9 nor e0c1142 is in rewrite branch, yet.

polcak · 2020-05-13T06:43:52Z

b240c61 pushed as afe712c

PeetHornak · 2020-05-13T06:55:58Z

Can 70199a9 replace e0c1142?

Note that neither 70199a9 nor e0c1142 is in rewrite branch, yet.

From my point of view, it can be replaced.

See #39

polcak · 2020-05-13T09:41:17Z

70199a9 merged by 45c9f84 instead of e0c1142

…kes Float out of it.

…keys)

* Freeze the wrapped object, otherwise, page script can simply 'delete' the wrapper to get original functionality * Introduce a proxy object with the possibility to detect it by is_proxy Symbol Note that both additions increases the fingerprintability of the browser, see: Michael Schwarz, Florian Lackner, and Daniel Gruss. 2019. JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits. In Network and Distributed Systems Security (NDSS) Symposium. See also #39 for more details about the context of this work.

polcak · 2020-05-18T15:24:19Z

Looking at b9e72fa, I am not completely sure why do we modify the wrap_code function. I prepared b77942c. Can you specify why do we modify the Proxy?

PeetHornak · 2020-05-18T15:53:23Z

I added is_proxy symbol, to not wrap objects that were already wrapped once, this ensures that mapping on memory is not done again. More on that can be found in the paper.

wrap_code doesn't have much impact. It just ensures that undefined statements are not in injected code.
I also added ${wrapper.post_replacement_code || ''} inside define_page_context_function which I used for executing code after replacement but still in the same scope. I noticed that this is missing in ff_bug version of this function.

polcak · 2020-05-18T15:58:42Z

In the JS Zero paper?

PeetHornak · 2020-05-18T16:15:29Z

I'm not sure to which part was this question aimed at.

is_proxy was not proposed in JS Zero paper, but as I mentioned, there was a lot of functionality missing. Yet I'm aware of bigger fingerprintability caused by this. I wasn't sure how to do it otherwie.

ff_bug version meaning function define_page_context_function_ffbug that is replacing define_page_context_function in case of blocking by CSP on Firefox. It should be added there to ensure same behavior on both browsers.

EDIT: To be honest I'm not sure where to add this piece of code in case of define_page_context_function_ffbug since I didn't encounter issues with CSP myself and don't know the behavior.

polcak · 2020-05-18T16:24:05Z

It was about "I added is_proxy symbol, to not wrap objects that were already wrapped once, this ensures that mapping on memory is not done again. More on that can be found in the paper." I am not sure which paper. Do you mean your thesis draft?

For more information about the FF bug see #25. As mentioned in the comment, the fix is not working correctly.

PeetHornak · 2020-05-18T16:26:34Z

Oh yes. I meant the thesis draft I sent you.

For more information about the FF bug see #25. As mentioned in the comment, the fix is not working correctly.

Thank you, I will have a look at it.

…it will always return as it will be stored in lastValue. (Google maps issue)

polcak · 2020-05-19T07:34:38Z

Going back to the Proxy matter: b9e72fa wraps the Proxy even if every wrapping is disabled (level 0). Why is that necessary?

Anyway, I split b9e72fa into 34cd8d3 and d4bb269 but some code from the original is still missing.

Please can you polish this whole threads of commits. It is very time consuming to go the commits one-by-one and fix the same issues again and again. Often, the commits cover more than one atomic change and the commit log does not explain why is the code needed in the presented form.

I suggest reading some of the articles about writing commits, such as https://duckduckgo.com/html?q=how%20to%20write%20a%20good%20commit, then, rewriting the history and then pulling again.

polcak · 2020-05-19T07:41:16Z

Also, bd60552 fixes an issue introduced by ae15072. Please fix ae15072 which is a part of this commit series.

polcak · 2020-05-19T15:21:37Z

#41 fixes the issue of inserting code when there is nothing to be wrapped. However, I am still concerned that blindly wrapping Proxy is not a good approach. There should be a valid reason to do so.

PeetHornak · 2020-05-19T15:29:28Z

Yes I completely agree with you about the Proxy. I will add it as a part of array wrapping, because it is used only there.

I will split these changes into separate pull requests, so we can have separate discussion a not everything here. As you said, it will be easier for you to review and then we can merge each pull request as one security measure.

PeetHornak · 2020-05-20T17:41:48Z

I created pull request for each of the sub tasks so it is easier to review and comment.
Thus we can probably close this pull request.
Hope it is better now, sorry for making a mess out of commits.

peter.hornak added 10 commits May 12, 2020 18:09

Change parsing of domains, look at setup for specific sub domains also.

409f3dd

Fix issue with running on Chrome

e0c1142

Fix Makefile issue on MacOS

b240c61

Change general wrapping, add object freeze to wrapped objects, wrap p…

b9e72fa

…roxy object so it can be detected using is_proxy Symbol

Add possibility of random noise in timers, wrap PerformanceEntry obje…

9c1cc52

…ct to disable exploits of performance.mark()

Fix: In Firefox navigator.deviceMemory can be undefined wrapping it l…

27a079b

…eads to error.

Add wrapping of batery status API on every level except level 0.

0c56a04

Add wrapping of SharedArrayBuffer

bbfccd0

Add WebWorker wrapping and polyfill

4030766

Add wrapping of TypedArray and DataView

5bd735c

PeetHornak changed the base branch from master to rewrite May 12, 2020 17:08

PeetHornak mentioned this pull request May 12, 2020

Implement functionality proposed in JavaScript Zero #37

Closed

Add PerformanceEntry wrapping, make it working

ae15072

polcak added a commit that referenced this pull request May 13, 2020

Fix chrome detection

70199a9

See also #39 and commit e0c1142

polcak mentioned this pull request May 13, 2020

Port functionality from ChromeZero #5

Closed

polcak added a commit that referenced this pull request May 13, 2020

Merge changes improving chrome support

45c9f84

See #39

peter.hornak added 2 commits May 15, 2020 17:00

Fix Arrays: off by one error in random access to array

a069263

Fix random noise: Date.now() is returning Int while noise function ma…

242e0b2

…kes Float out of it.

PeetHornak force-pushed the ph/jsr2 branch from ef99df4 to 242e0b2 Compare May 16, 2020 17:42

peter.hornak added 4 commits May 16, 2020 20:05

Add missing colon

bd60552

Fix TypedArrays: type3 methods not working properly(entries, values, …

7b29275

…keys)

Fix DataView: Wrong setting of ints

effa9bc

Add Unit tests

cacb914

PeetHornak force-pushed the ph/jsr2 branch from 76fe74e to cacb914 Compare May 16, 2020 19:29

Fix DataView: Incorrect setting of BigInt

68640a1

polcak added this to the 0.3 milestone May 18, 2020

Fix Date: In case of constructor having parameters with future time, …

5510a7c

…it will always return as it will be stored in lastValue. (Google maps issue)

polcak linked an issue May 19, 2020 that may be closed by this pull request

Port functionality from ChromeZero #5

Closed

polcak marked this pull request as draft May 19, 2020 15:24

polcak added the enhancement New feature or request label May 19, 2020

polcak closed this May 22, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement functionality proposed in JavaScript Zero #39

Implement functionality proposed in JavaScript Zero #39

PeetHornak commented May 12, 2020

polcak commented May 13, 2020

polcak commented May 13, 2020

polcak commented May 13, 2020

PeetHornak commented May 13, 2020

polcak commented May 13, 2020

polcak commented May 18, 2020

PeetHornak commented May 18, 2020

polcak commented May 18, 2020

PeetHornak commented May 18, 2020 •

edited

Loading

polcak commented May 18, 2020

PeetHornak commented May 18, 2020

polcak commented May 19, 2020

polcak commented May 19, 2020

polcak commented May 19, 2020

PeetHornak commented May 19, 2020 •

edited

Loading

PeetHornak commented May 20, 2020

Implement functionality proposed in JavaScript Zero #39

Implement functionality proposed in JavaScript Zero #39

Conversation

PeetHornak commented May 12, 2020

polcak commented May 13, 2020

polcak commented May 13, 2020

polcak commented May 13, 2020

PeetHornak commented May 13, 2020

polcak commented May 13, 2020

polcak commented May 18, 2020

PeetHornak commented May 18, 2020

polcak commented May 18, 2020

PeetHornak commented May 18, 2020 • edited Loading

polcak commented May 18, 2020

PeetHornak commented May 18, 2020

polcak commented May 19, 2020

polcak commented May 19, 2020

polcak commented May 19, 2020

PeetHornak commented May 19, 2020 • edited Loading

PeetHornak commented May 20, 2020

PeetHornak commented May 18, 2020 •

edited

Loading

PeetHornak commented May 19, 2020 •

edited

Loading