ABSTRACT Most current web browsers employ a monolithic architec ture that combines the user and the web into a single protection domain An attacker who exploits an arbitrary code execution vulnerability in such a browser can steal sen sitive 64257le ID: 40094
Download Pdf The PPT/PDF document "The Security Architecture of the Chromiu..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
letoanentireinstanceoftherenderingengine,evenwhenthatprivilegeisonlyneededbyasinglesecurityorigin.Thearchitecturedoesnotpreventanattackerwhocompro-misestherenderingenginefromattackingotherwebsites(forexample,byreadingtheircookies).Instead,thearchi-tectureaimstopreventanattackerfromreadingorwritingtheuser'slesystem,helpingprotecttheuserfromadrive-bymalwareinstallation.ToevaluatethesecurityofChromium'sarchitecture,weexaminethedisclosedbrowservulnerabilitiesinInternetEx-plorer,Firefox,andSafarifromtheprecedingyear.Foreachvulnerability,wedeterminewhichmodulewouldhavebeena ectedbythevulnerability,hadthevulnerabilitybeenpresentinChromium.Wendthat67:4%(87of129)ofthevulnerabilitieswouldhaveoccurredintherenderingengine,suggestingthattherenderingengineaccountsforasigni-cantfractionofthebrowser'scomplexity.NotallrenderingenginevulnerabilitieswouldhavebeenmitigatedbyChromium'sarchitecture.Chromium'sarchi-tectureisdesignedtomitigatethemostseverevulnerabili-ties,namelythosevulnerabilitiesthatletanattackerexecutearbitrarycode.Ifanattackerexploitssuchavulnerabilityintherenderingengine,Chromium'sarchitectureaimstore-stricttheattackertousingthebrowserkernelinterface.Wendthat38ofthe87renderingenginevulnerabilitiesal-lowedanattackertoexecutearbitrarycodeandwouldhavebeenmitigatedbyChromium'sarchitecture.Theseaccountfor70:4%(38of54)ofalldisclosedvulnerabilitiesthatallowarbitrarycodeexecution.Toevaluatethesecuritybenetsofsandboxingadditionalbrowsercomponents,weexaminedthearbitrarycodeexecu-tionvulnerabilitiesthatwouldhaveoccurredinthebrowserkernel.Wendthat72:7%(8of11)ofthevulnerabilitiesresultfrominsucientvalidationofsystemcallsandwouldnothavebeenmitigatedbyadditionalsandboxing.Forex-ample,onesuchvulnerabilityinvolvedthebrowserimprop-erlyescapingaparametertoShellExecutewhenhandlingexternalprotocols.Althoughcountingvulnerabilitiesisanimperfectsecuritymetric[24],theseobservationsleadustobelievethatChromium'sarchitecturesuitablydividesthevariousbrowsercomponentsbetweenthebrowserkernelandtherenderingengine.Byseparatingthebrowserintotwoprotectiondomains,onerepresentingtheuserandanotherrepresentingtheweb,Chromium'ssecurityarchitecturemitigatesapproximately70%ofcriticalbrowservulnerabilitiesthatletanattackerexecutearbitrarycode.Theremainingvulnerabilitiesarediculttomitigatewithadditionalsandboxing,leadingustoconcludethatthearchitectureextractsmostofthesecu-ritybenetsofsandboxingwhilemaintainingperformanceandcompatibilitywithexistingwebcontent.Wetookathree-prongedapproachtoevaluatingthecom-patibilityofChromium'sarchitecture.First,ourimplemen-tationofthearchitecturepasses99%of10;115compatibilitytestsfromtheWebKitproject.Thetestsourimplementa-tiondoesnotpassareduetoimplementationdetailsandarenotduetoarchitecturallimiations.Second,weman-uallyvisitedeachofthe500mostpopularwebsitesandxedanyincompatibilitieswefound.Third,wedeployourimplementationtomillionsofusersworld-wide. Figure1:Thebrowserkerneltreatstherenderingengineasablackboxthatparseswebcontentandemitsbitmapsoftherendereddocument. Organization.Section2denesathreatmodelforbrowserexploits.Section3detailsChromium'sarchitecture.Sec-tion4describesthesandboxusedtoconnetherenderingengine.Section5explainsthebrowserkernelAPIusedbythesandboxedrenderingengine.Section6evaluatesthese-curitypropertiesofthearchitecture.Section7comparesChromium'sarchitecturewithotherbrowserarchitectures.Section8concludes.2.THREATMODELInordertocharacterizethesecuritypropertiesofChro-mium'sarchitecture,wedeneathreatmodelbyenumerat-ingtheattacker'sabilitiesandgoals.Thesecurityarchitec-tureseekstopreventanattackerwiththeseabilitiesfromreachingthesegoals.Wecanusethisthreatmodeltoeval-uatehowe ectivelyChromium'sarchitectureprotectsusersfromattack.AttackerAbilities.Weconsideranattackerwhoknowsanunpatchedsecurityvulnerabilityintheuser'sbrowserandisabletoconvincetheuser'sbrowsertorendermaliciouscontent.Typically,theseabilitiesaresucienttocompro-misetheuser'smachine[20].Morespecically,weassumetheattackerhasthefollowingabilities:1.Theattackerownsadomainname,sayattacker.com,thathasnotyetbeenaddedtothebrowser'smalwareblacklist[19].TheattackerhasavalidHTTPScer-ticateforthedomain,andcontrolsatleastonehostonthenetwork.Theseabilitiescanbepurchasedforabout$5.2.Theattackerisabletoconvincetheusertovisithisorherwebsite.Thereareanumberoftechniquesforconvincingtheusertovisitattacker.com,suchassendingoutspame-mail,hostingpopularcontent,ordrivingtracviaadvertising.Itisdiculttopricethisability,but,inapreviousstudy,wewereabletoattractaquarterofamillionusersforabout$50[1].2 3.Theattackerknows,andisabletoexploit,anun-patchedarbitrarycodeexecutionvulnerabilityintheuser'swebbrowser.Forexample,theattackermightknowofanunpatchedbu erover owinthebrowser'sHTMLparser[17],anintegerover owintheregu-larexpressionlibrary[14],orabu erover owinthebookmarkssystem[15].In-ScopeGoals.Chromium'sarchitecturefocusesonpre-ventingtheattackerfromachievingthreehigh-valuegoals:PersistentMalware.Theattackerattemptstoin-stallmalicioussoftwareontheuser'scomputer.Forexample,theattackermightattempttoinstallabot-netclient[6]thatreceivescommandsoverthenet-workandparticipatesincoordinatedattacksontheuseroronnetworktargets.Inparticular,theattackerattemptstoinstallpersistentmalicioussoftwarethatsurvivestheuserclosinghisorherbrowser.TransientKeylogger.Theattackerattemptstomon-itortheuser'skeystrokeswhentheuserinteractswithanotherprogram.Suchsystem-widekeyloggersareof-tenusedtostealuserpasswords,creditcardnumbers,andothersensitiveinformation.Toachievethisgoal,theattacker'skeyloggerneednotsurvivetheuserclos-ingthebrowser.FileTheft.Theattackerattemptstoreadsensitivelesontheuser'sharddrive.Forexample,theattackermightattempttoreadthesystem'spassworddatabaseortheuser'snancialrecords.Filetheftisanimpor-tantconcernforenterpriseuserswhosemachinesoftencontainlargeamountsofcondentialinformation.Ifanattackerisabletoachieveoneormoreofthesegoals,heorshehastheabilitytocauseseriousharmtotheuser.Forexample,anattackerwhoisabletoinstallmalwareisnolongerconstrainedbythebrowser'ssecuritypolicyandoftensaidto\own"theuser'smachine.Chromium'sarchitectureaimstopreventanattackerwiththeaboveabilitiesfromachievingthesegoals.Out-of-ScopeGoals.Thereareanumberofotherat-tackergoalsforwhichChromium'sarchitecturedoesnotprovideadditionalprotection.Chromiumincludesfeaturesthathelpdefendagainstthesethreats,butthesefeaturesrelyontherenderingenginetoenforcethesame-originpol-icy.Phishing.Inaphishingattack,theattackertrickstheuserintoconfusingadishonestwebsitewithanhonestwebsite.Theconfusedusersupplieshisorherpasswordtothedishonestwebsite,whocanthenim-personatetheuseratthehonestwebsite.Anattackerwhoexploitsanunpatchedvulnerabilitycancreateaconvincingphishingsitebycorruptingawindowdis-playingthehonestsite.Chromiumhasanumberofsecurityfeaturestohelpmitigatephishingattacks.Forexample,thebrowser'slocationbarhighlightsthewebsite'sdomainname,aidingusersindeterminingwhethertheyareviewinganhonestoradishonestwebsite.Thebrowseralsoblack-listsknownphishingsites,showingafull-pagewarningiftheuservisitsaknownphishingsite.Addi-tionally,thebrowserdisplaysadditionalsecurityuserinterfaceelementsifthesitehasanextendedvalida-tioncerticate.ManyofthesesecurityfeaturescanbefoundinotherbrowsersandareorthogonaltothedesignofChromium'sarchitecture.OriginIsolation.Chromium'sarchitecturetreatstherenderingengineasrepresentingtheentirewebprincipal,meaninganattackerwhocompromisestherenderingenginecanactonbehalfofanywebsite.Forexample,anattackerwhoexploitsanarbitrarycodeexecutionvulnerabilitycanobtainthecookiesforev-erywebsiteandcanreadallthepasswordsstoredinthebrowser'spassworddatabase.Iftheattackerisnotabletoexploitanunpatchedvulnerability,theusualbrowsersecuritypolicypreventstheattackerfromread-ingcookiesorpasswordsfromhostnamesthatarenotunderhisorhercontrol.FirewallCircumvention.Thesame-originpolicyisdesignedtorestrictanattacker'snetworkaccessfromwithinthebrowser[9].Theserestrictionsareintendedtoprotectcondentialresourcesbehindorganizationalrewalls.However,anattackerwhoexploitsanun-patchedvulnerabilitycanbypasstheserestrictionsandcanreadHTTPresponsesfrominternalserversbymakinguseofthebrowser'sURLrequestingfacilities.TheabilitytorequestarbitrarywebURLsfollowsthecompatibilityandblack-boxdesigndecisionsinordertosupportstylesheetsandimagetags.WebSiteVulnerabilities.Chromium'sarchitec-turedoesnotprotectanhonestwebsiteifthesitecontainscross-sitescripting(XSS),cross-siterequestforgery(CSRF),orheaderinjectionvulnerabilities.Tobesecureagainstwebattackers,thesesitesmustrepairtheirvulnerabilities.ChromiumsupportsHttpOnlycookies[12],whichcanbeusedasapartialmitigationforXSS.3.CHROMIUM'SARCHITECTUREChromium'sarchitecturehastwomodules:arenderingengineandabrowserkernel.Atahighlevel,therender-ingengineisresponsibleforconvertingHTTPresponsesanduserinputeventsintorenderedbitmaps,whereasthebrowserkernelisresponsibleforinteractingwiththeoper-atingsystem.ThebrowserkernelexposesanAPIthattherenderingengineusestoissuenetworkrequests,accessper-sistentstorage,anddisplaybitmapsontheuser'sscreen.Thebrowserkernelistrustedtoactastheuser,whereastherenderingengineistrustedonlytoactastheweb.RenderingEngine.Therenderingengineinterpretsandexecuteswebcontentbyprovidingdefaultbehav-iors(forexample,drawing&#xinpu;&#xt000;elements)andbyservicingcallstotheDOMAPI.Renderingwebcon-tentproceedsinseveralstages,beginningwithparsing,buildinganin-memoryrepresentationoftheDOM,layingoutthedocumentgraphically,andmanipulat-ingthedocumentinresponsetoscriptinstructions.Therenderingengineisalsoresponsibleforenforcingthesame-originpolicy,whichhelpspreventmaliciouswebsitesfromdisruptingtheuser'ssessionwithhon-estwebsites.3 4.THESANDBOXTohelpdefendagainstanattackerwhoexploitsavulner-abilityintherenderingengine,Chromiumrunseachrender-ingengineinasandbox.Thissandboxrestrictstherenderingengine'sprocessfromissuingsomesystemcallsthatcouldhelptheattackerreachthegoalsfromSection2.Goals.Ideally,thesandboxwouldforcetherenderingen-ginetousethebrowserkernelAPItointeractwiththeout-sideworld.ManyDOMmethods,suchasappendChild,simplymutatestatewithintherenderingengineandcanbeimplementedentirelywithintherenderingengine.OtherDOMmethods,suchasXMLHttpRequest'ssendmethod,re-quirethattherenderingenginedomorethanjustmanipu-lateinternalstate.Anhonestrenderingenginecanusethebrowserkernelinterfacetoimplementthesemethods.Thegoalofthesandboxistorequireevenacompromisedren-deringenginetousethebrowserkernelinterfacetointeractwiththelesystem.Implementation.Currently,ChromiumreliesonWindows-specicfeaturestosandboxtherenderingengine.Insteadofrunningwiththeuser'sWindowssecuritytoken,therender-ingenginerunswitharestrictedsecuritytoken.Whenevertherenderingengineattemptstoaccessa\securableob-ject,"theWindowsSecurityManagercheckswhethertherenderingengine'ssecuritytokenhassucientprivilegestoaccesstheobject.Thesandboxrestrictstherenderingen-gine'ssecuritytokeninsuchawaythatthetokenfailsalmosteverysuchsecuritycheck.Beforerenderingwebcontent,therenderingenginead-juststhesecuritytokenofitsprocessbyconvertingitsse-curityidentiers(SIDs)to\DENY_ONLY,"addingarestrictedSID,andcallingtheAdjustTokenPrivilegesfunction.Therenderingenginealsorunsonaseparatedesktop,mitigat-ingthelaxsecuritycheckingofsomeWindowsAPIs,suchasSetWindowsHookEx,andlimitingtheusefulnessofsomeunsecuredobjects,suchasHWND_BROADCAST,whosescopeislimitedtothecurrentdesktop.Additionally,therenderingenginerunsinaWindowsJobObject,restrictingtheren-deringengine'sabilitytocreatenewprocesses,readorwritetotheclipboard,oraccessUSERhandles.Otherresearchershaveadvocatedsimilarapproaches[10].ForfurtherdetailsabouttheChromiumsandbox,seethedesigndocument[4].Limitations.Althoughthesandboxrestrictstheabilityofacompromisedrenderingenginetointeractwiththeoper-atingsystem,thesandboxhassomelimitations:FAT32.TheFAT32lesystemdoesnotsupportac-cesscontrollists.Withoutaccesscontrollists,theWindowssecuritymanagerignoresaprocess'ssecu-ritytokenwhengrantingaccesstoaFAT32le.TheFAT32lesystemisrarelyusedonmodernharddrivesbutisusedonmanyUSBthumbdrives.Forexample,ifausermountsaUSBthumbdrivethatusesFAT32,acompromisedrenderingenginecanreadandwritethecontentsofthedrive.MisconguredObjects.IfanobjecthasaNULLdiscretionaryaccesscontrollist(DACL),theWindowssecuritymanagerwillgrantaccesswithoutconsideringtheaccessingsecuritytoken.AlthoughNULLDACLsareuncommon,somethird-partyapplicationscreateobjectswithNULLDACLs.OntheNTFSlesystem,thislimitationislargelymitigatedbecausethesand-boxremovestheprivilegeto\bypasstraversecheck-ing,"forcingWindowstocheckthattherenderingen-ginehasaccesstothetargetle'sparentdirectories.TCP/IP.Theoretically,therenderingenginecouldcreateaTCP/IPsocketonWindowsXPbecausethelow-levelsystemcallstoopenasocketdonotappeartorequireOShandlesortoperformaccesschecks.Inpractice,though,theusualWin32librarycallsforcre-atingasocketfail,becausethoseAPIsrequirehandleswhichtherenderingengineisunabletoobtain.Wehaveattemptedtobuildaproof-of-conceptbutareasyetunabletoopenasocketfromwithinasandboxedprocess.OnWindowsVista,therelevantsystemcallsperformaccesschecksbasedonthecurrentsecuritytoken.5.THEBROWSERKERNELINTERFACEThesandboxrestrictstherenderingengine'sabilitytoin-teractdirectlywiththeunderlyingoperatingsystem.Toac-cessoperatingsystemfunctionality,suchasuserinteraction,persistentstorage,andnetworking,therenderingenginere-liesonthebrowserkernelAPI.Inprovidingfunctionalitytotherenderingengine,thebrowserkernelmustbecarefullydesignednottograntmoreprivilegesthanarenecessary.Inparticular,thebrowserkernelinterfaceisdesignednottoleaktheabilitytoreadorwritetheuser'slesystem.UserInteraction.Commodityoperatingsystemsexposeaninterfacethatletsapplicationsinteractwiththeuser,buttheseinterfacesareoftennotdesignedtobeusedbyuntrustedapplications.Forexample,intheXWindowSys-tem,theabilitytocreateawindowonanXserveralsoimpliestheabilitytomonitoralloftheuser'skeystrokes[2].Thebrowserkernelmediatestherenderingengine'sinterac-tionwiththeusertohelpenforcetwosecurityconstraints:Rendering.Insteadofgrantingtherenderingenginedirectaccesstoawindowhandle,therenderingenginedrawsintoano -screenbitmap.Todisplaythebitmaptotheuser,therenderingenginesendsthebitmaptothebrowserkernel,andthebrowserkernelcopiesthebitmaptothescreen.Thisdesignaddsasinglevideomemorytovideomemorycopytotheusualdrawingpipeline,whichhasasimilarlysmallperformanceim-pacttodoublebu ering,andclipstherenderedbitmaptothebrowserwindow'scontentarea.1UserInput.Insteadofdeliveringuserinputeventsdirectlytotherenderingengine,theoperatingsys-temdeliverstheseeventstothebrowserkernel.Thebrowserkerneldispatchestheseeventsaccordingtothecurrentlyfocuseduserinterfaceelement.Iffocusre-sidesinthebrowserchrome,theinputeventsarehan-dledinternallybythebrowserkernel.Ifthecontentareahasfocus,thebrowserkernelforwardstheinputeventstotherenderingengine.Thisdesignleveragestheuser'sintent(whichinterfaceelementisinfocus)torestrictwhichuserinputeventscanbeobservedbyacompromisedrenderingengine. 1IntheinitialbetareleaseofGoogleChrome,thebrowserkernelalsoexposesanAPIfordrawingmenusforthe&#xsele;t00;elementthatcanbeusedtodrawoverarbitraryregionsofthescreen.5 Browser Renderer Unclassied InternetExplorer 1 9 5 Firefox 5 19 0 Safari 5 10 0 Table3:NumberofArbitraryCodeExecutionCVEsbyChromiumModuleTheunclassiedvulnerabilityinSafariwaspresentinSafari'sPDFviewer.(Chromiumdoesnotcontainabuilt-inPDFviewer.)Table2revealsthatrenderingenginesaccountforthegreat-estnumberofdisclosedvulnerabilities,suggestingthattherenderingengineismorecomplexthanthebrowserkernel.Thisobservationisconsistentwiththelinecountheuristicforcodecomplexity.Chromium'srenderingenginecontainsapproximately1;000;000linesofcode(excludingblanklinesandcomments),whereasthebrowserkernelcontainsap-proximately700;000linesofcode.ArbitraryCodeExecution.Chromium'ssecurityarchi-tectureisdesignedtomitigatetheimpactofarbitrarycodeexecutionvulnerabilitiesintherenderingenginebylimitingtheabilityoftheattackertoissuesystemcallsaftercom-promisingtherenderingengine.ManyofthevulnerabilitiesconsideredabovearenotmitigatedbyChromium'sarchitec-turebecausetheydonotletanattackerreadorwritetheuser'slesystem.Forexample,oneoftheFirefoxvulnera-bilitiesletanattackerlearntheURLofthepreviouspage.Whilepatchingthesevulnerabilitiesisimportanttoprotecttheuser'sprivacy(andsensitiveinformation),thesevulnera-bilitiesarenotassevereasvulnerabilitiesthatletwebsitesinstallmaliciousprograms,suchasbotnetclients[20],ontheuser'smachine.Ifwerestrictourattentiontothosevulnerabilitiesthatleadtoarbitrarycodeexecution(seeTable3),wendthattherenderingenginecontainedmorearbitrarycodeexecu-tionvulnerabilitiesthanthebrowserkernel.(Asmentionedabove,thefourunclassiedInternetExplorervulnerabilitieswererelatedtoActiveXplug-insandonecontainedinsuf-cientinformationtodeterminethemodule.)Chromium'sarchitecturehelpsmitigatethesevulnerabilitiesbysandbox-ingthearbitrarycodetheattackerchoosestoexecute.Ofthevulnerabilitiesinthebrowserkernelthatleadtoarbitrarycodeexecution,themajority(8of11)ofthesevulnerabilitieswerecausedbyinsucientvalidationofin-putstosystemcallsandnotbybu erover owsorothermemory-safetyissues.Thesevulnerabilitiesareunlikelytobemitigatedbysandboxingmorebrowsercomponentsbe-causethebrowsermusteventuallyissuethesystemcallsinquestion,suggestingthatothertechniquesarerequiredtomitigatetheseissues.Summary.Although\numberofCVEs"isnotanidealse-curitymetric,thisdatasuggeststhatChromium'sdivisionofresponsibilitiesbetweenthebrowserkernelandtheren-deringengineplacesthemorecomplex,vulnerability-pronecodeinthesandboxedrenderingengine,makingitharderforanattackertoreadorwritetheuser'sharddrivebyex-ploitingavulnerability.Moreover,mostoftheremainingvulnerabilitieswouldnothavebeenmitigatedbyadditionalsandboxing,suggestingthatassigningmoretaskstotheren-deringenginewouldnotsignicantlyimprovesecurity.6.2CaseStudy:XMLExternalEntitiesAnothermethodforevaluatingChromium'ssecurityar-chitectureistodeterminewhetherthearchitecturesuccess-fullydefendsagainstunknownvulnerabilitiesintherender-ingengine.Inthiscasestudy,weexamineonevulnerabilityindetailandexplainhowthesecurityarchitecturemitigatedthreatsinthescopeofourthreatmodelbutdidnotmit-igatethreatsthatareoutofscope.Thisvulnerabilityis\unknown"inthesensethatwediscoveredthevulnerabilityafterimplementingthesandboxandbrowserkernelsecuritymonitor.Thevulnerabilitywasxedbeforetheinitialbetarelease,butthissectiondescribesthestateofa airsjustafterwediscoveredthevulnerability.XXE.AnXMLEntityisanescapesequence,suchas©,thatanXML(oranHTML)parserreplaceswithoneormorecharacters.Inthecaseof©,theentityisre-placedwiththecopyrightsymbol,c .TheXMLstandardalsoprovidesforexternalentities[3],whicharereplacedbythecontentobtainedbyretrievingaURL.InanXmleXternalEntity(XXE)attack,theattacker'sXMLdocument,hostedathttp://attacker.com/,includesanexternalentityfromaforeignorigin[25].Forexample,themaliciousXMLdocumentmightcontainanentityfromhttps://bank.com/orfromfile:///etc/passwd:version="1.0"&#x?xml;&#x-525;encoding="UTF-8"?doc[entSYSTEM&#x!ENT;&#xITY-;剐"/etc/passwd"&#x!ENT;&#xITY-;剐]&#xhtml;&#xhead;&#xscri;&#xpt00;...&#x/scr;&#xipt0;&#x/hea;퀀 ody;&#x/bod;&#xy000;&#x/htm;&#xl000;IfvulnerabletoXXEattacks,thebrowserwillretrievethecontentfromtheforeignoriginandincorporateitintotheattacker'sdocument.Theattackercanthenreadthecon-tent,circumventingacondentialitygoalsofthebrowser'ssecuritypolicy.libXML.Likemanybrowsers,ChromiumuseslibXMLtoparseXMLdocuments.Unlikeotherbrowsers,Chromiumdelegatesparsingtasks,includingXMLparsing,toasand-boxedrenderingengine.Afterimplementingthesandbox,butpriortotheinitialbetareleaseofGoogleChrome,webecameawarethattherenderingengine'suseoflibXMLwasvulnerabletoXXEattacks.Asaresult,therenderingenginewasnotpreventingwebcontentfromretrievingURLsfromforeignorigins.Instead,therenderingenginewaspassingtherequests,unchecked,tothebrowserkernel.Usingourproof-of-conceptexploit,weobservedthatthebrowserkernelperformeditsusualblack-boxchecksontheURLsrequestedbytherenderingengine.IftheexternalentityURLwasawebURL,forexamplewiththehttp,https,orftpschemes,thebrowserkernelservicedthere-quest,asinstructed.However,iftheexternalentityURLwasfromtheuser'slesystem,i.e.fromthefilescheme,thenthebrowserkernelblockedtherequest,preventingourproof-of-conceptfromreadingcondentialinformation,suchaspasswords,storedintheuser'slesystem.Discussion.ThevulnerabilityillustratesthreepropertiesofChromium'ssecurityarchitecture:1.Byparsingwebcontentinthesandboxedrenderingen-gine,Chromium'ssecurityarchitecturemitigatedanunknownvulnerability.Thesandboxhelpedprevent7 theJavaScriptinterpretor,thenetworkstack,andthecookiestoreinseparatemodules.IntheOParchitecture,thebrowserkernelismoreakintoamicro-kernel:chie yresponsibleformessagepass-ing.Thisdesignmitigatesunpatchedvulnerabilitiesbutdoesnotsupportanumberofwidelyusedbrowserfeatures,suchasinter-framescripting,downloads,anduploads.Forexample,theOPbrowserwouldnotbecompatiblewithGmail,whichusesofallofthesefea-tures.TheOPbrowser'ssandboxingofplug-insisalsomorerestrictivethanChromium's--safe-pluginsop-tion,imposingahighercompatibilitycost.Forexam-ple,OP'sarchitecturedoesnotsupportFlashPlayer'scross-domaincommunicationmechanisms(LocalCon-nectionandURLRequest).UnlikeChromium,theOPwebbrowser'srenderingen-gineusesXWindowstodrawtotheuser'sscreen.Un-fortunately,theXWindowsAPIisnotdesignedforsecurity.Acompromisedrenderingenginecansnoopontheuser'skeystrokesordisrupttheintegrityoftheuser'swindowenvironmentbydrawingtoarbitraryre-gionsofthescreen.Forexample,theattackercouldoverwritethebrowser'saddressbar.AlthoughtheOPbrowserseekstoprotectwebsitesfromeachother,anattackercanstillexploitrenderingenginevulnerabilitiestocompromiseothersites.Forexample,supposetheattackerknowsanarbitrarycodeexecutionvulnerabilityinthebrowser'simageparser.Ifanhonestsiteincludesanimagefromtheattacker,e.g.&#ximg-;剐src="http://attacker.com/img.gif",theOPbrowserdecodesthisimageinthehonestsite'sse-curitycontext.Bymaliciouslycraftingtheimage,theattackercanexploitthisvulnerabilityandcompromisethehonestsite'ssecuritycontext,violatingthesecu-ritypropertycheckedbytheirmodel.InternetExplorer8.InternetExplorer8runstabsinseparateprocesses,eachofwhichrunsinprotectedmode.Thisarchitectureisdesignedtoimproverelia-bility,performance,andscalability[28].BecauseIn-ternetExplorer8'sprotectedmodeisthesameasIn-ternetExplorer7'sprotectedmode,itdoesnotprovideanyadditionalsecurity.UnlikeChromium,protectedmodedoesnotseektoprotectthecondentialityoftheuser'slesystem[23].8.CONCLUSIONSChromium'ssecurityarchitecturedividesthebrowserintotwoprotectiondomains,thebrowserkernelandtherender-ingengine.Thesandboxedrenderingengineisresponsibleforperformingmanycomplex,error-pronetasks,suchasparsingHTMLandexecutingJavaScript.Asaresult,thearchitecturehelpsprotectthecondentialityandintegrityoftheuser'slesystemevenifanattackerexploitsanun-patchedvulnerabilityintherenderingengine.Ourdesigndecisionsdi erfromthoseofotherproposalsforamodularbrowserarchitecture.Beingcompatiblewithexistingsitesrequiresthatthearchitecturesupportsallthefeaturesofthewebplatform.Treatingtherenderingengineasablackboxreducesthecomplexityofthebrowserkernel'ssecuritymonitor.Minimizesusersecuritydecisionsavoidsconstantsecurityprompts.OnedicultyinevaluatingthesecurityofChromium'sarchitectureisthatitaimstoprovidesecurityeveniftheimplementationhasbugs.Wecannotsimplyassumethatallvulnerabilitieswillariseintherenderingenginebecausethebrowserkernelisalsoofsignicantcomplexity.Toestimatewherefuturevulnerabilitiesmightoccur,wesurveyrecentbrowservulnerabilitiesandndthat67:4%(87of129)wouldhaveoccurredintherenderingenginehadtheybeenpresentinChromium.Wealsondthatthearchitecturewouldhavemitigated70:4%(38of54)ofthemostseverevulnerabilities.Ofthearbitrarycodeexecutionvulnerabilitiesthatwouldhaveoccurredinthebrowserkernel,8of11arearesultofin-sucientvalidationofparameterstooperatingsystemcalls.Thesevulnerabilitiesarediculttomitigatewithsandbox-ingbecausethebrowsermusteventuallyissuethosesys-temcallstorenderwebsites.TheseobservationssuggestthatChromium'sarchitecturedivisionoftasksbetweenthebrowserkernelandtherenderingengineusesthesandboxe ectively.Todownloadanimplementationofthearchitecture,visithttp://www.google.com/chrome/.Thesourcecodeofourimplementationisavailableathttp://dev.chromium.org/.9.REFERENCES[1]AdamBarth,CollinJackson,andJohnC.Mitchell.Robustdefensesforcross-siterequestforgery.In15thACMConferenceonComputerandCommunicationsSecurity(CCS),October2008.[2]RuneBraathen.CrashcourseinXWindowssecurity,November1994.http://www.ussg.iu.edu/usail/external/recommended/Xsecure.html.[3]TimBray,JeanPaoli,C.M.Sperberg-McQueen,EveMaler,andFrancoisYergeau.ExtensibleMarkupLanguage(XML)1.0(FourthEdition),section4.2.2.http://www.w3.org/TR/REC-xml/#sec-external-ent.[4]TheChromiumAuthors.Sandbox,2008.http://dev.chromium.org/developers/design-documents/sandbox.[5]RichardS.Cox,JacobGormHansen,StevenD.Gribble,andHenryM.Levy.Asafety-orientedplatformforwebapplications.InIEEESymposiumonSecurityandPrivacy,2006.[6]NeilDaswani,MichaelStoppelman,andtheGoogleClickQualityandSecurityTeams.TheanatomyofClickbot.A.InProceedingsofHotBots2007,2007.[7]ChrisGrier,ShuoTang,andSamuelT.King.Securewebbrowsingwiththeopwebbrowser.InIEEESymposiumonSecurityandPrivacy,2008.[8]SotirisIoannidisandStevenM.Bellovin.Buildingasecurewebbrowser.InProceedingsoftheUSENIXAnnualTechnicalConference,FreenixTrack,June2001.[9]CollinJackson,AdamBarth,AndrewBortz,WeidongShao,andDanBoneh.ProtectingbrowsersfromDNSrebindingattacks.InProceedingsofthe14thACMConferenceonComputerandCommunicationsSecurity(CCS2007),November2007.[10]DavidLeBlanc.PracticalWindowssandboxing,July2007.http://blogs.msdn.com/david_leblanc/archive/2007/07.aspx.[11]Microsoft.Dynamic-linklibraryredirection.http://9