Pride and Prejudice in Progressive Web Apps : Abusing Native - - PowerPoint PPT Presentation

▶
pride and prejudice in progressive web apps abusing
SMART_READER_LITE
LIVE PREVIEW

Pride and Prejudice in Progressive Web Apps : Abusing Native - - PowerPoint PPT Presentation

Sep 11, 2023 443 likes •1.03k views

Pride and Prejudice in Progressive Web Apps : Abusing Native App-like Features in Web Applications Jiyeon Lee, Hayeon Kim, Junghwan Park, Insik Shin, Sooel Son School of Computing, Graduate School of Information Security 1 Limitations of Web

slide-1
SLIDE 1

Pride and Prejudice in Progressive Web Apps: Abusing Native App-like Features in Web Applications

Jiyeon Lee, Hayeon Kim, Junghwan Park, Insik Shin, Sooel Son School of Computing, Graduate School of Information Security

1
slide-2
SLIDE 2

Limitations of Web Apps

  • Users spend most of time in native apps
  • Reasons:

⁻ Heavily depend on network connection ⁻ Low user engagement

Source: comScore Mobile Metrix, U.S., Age 18+, June 2016

Apps 188.6 Webs 9.3

Average minutes per visitor 2
slide-3
SLIDE 3

Limitations of Native Apps

  • App usage is highly concentrated
  • Reasons:

⁻ High cost ⁻ Difficult to share

Monthly Unique Visitors (M)

Apps 4.0 Webs 11.4

Source: comScore Mobile Metrix, U.S., Age 18+, June 2016 3
slide-4
SLIDE 4

Progressive Web Apps (PWAs)

  • Introduced by Google in 2015
  • Three design goals: reliable, fast, engaging
  • Success stories

⁻ Twitter Lite ⁻ Financial Times ⁻ Forbes

Push Notifications Offline Browsing Add to Home Screen 4
slide-5
SLIDE 5 Push Notifications Offline Browsing Add to Home Screen
  • Introduced by Google in 2015
  • Three design goals: reliable, fast, engaging
  • Success stories

⁻ Twitter Lite ⁻ Financial Times ⁻ Forbes

Progressive Web Apps (PWAs)

5

Core Components: 1) Service Worker 2) Cache 3) Push

SERVICE WORKER CACHE PUSH

slide-6
SLIDE 6

This Study

  • We addressed the security and privacy risks to PWAs
6

Vulnerabilities: 1) Service Worker à Cryptocurrency Mining 2) Cache à Inferring User’s Browsing History 3) Push à Phishing Attack

SERVICE WORKER CACHE PUSH

slide-7
SLIDE 7

Technology behind PWAs: Service Worker

  • HTML5 Web standard technology
  • Supported by most browsers:

⁻ Firefox 44+, Chrome 45+, Edge 17+, Opera 32+

  • Only usable on HTTPS websites
  • Able to run in the background even when a user leaves a website

</>

SERVICE WORKER WEB APP NETWORK

7
slide-8
SLIDE 8

Offline Browsing

  • Cache is an origin-bounded local storage
  • Accessible regardless of the network status
  • Provides programmable offline interfaces with Service Worker
SERVICE WORKER CACHE INTERNET SERVICE WORKER CACHE 8
slide-9
SLIDE 9

Web Push Notifications

  • Re-engaging users with customized content
  • Can be received by Service Worker even if the browser is closed

SERVICE WORKER PUSH SERVER WEB SERVER

9
slide-10
SLIDE 10

How Many PWAs Exist in the Wild?

  • A PWA is a website that registers Service Worker
  • Collected from the Alexa top 100,000 websites

Features Used Number of websites Push 3,351 (80.5%) Cache 513 (12.3%) Both 196 (4.7%) Others 495 (11.9%) Total 4,163 (100%)

10
slide-11
SLIDE 11

I-I. Phishing Risks of Web Push

11
slide-12
SLIDE 12

General Appearance of Web Push

12
slide-13
SLIDE 13

General Appearance of Web Push

ICON TITLE BODY DOMAIN 13
slide-14
SLIDE 14

Sender Can Customize,

ICON TITLE BODY DOMAIN 14
slide-15
SLIDE 15

Sender Can Not Customize,

ICON TITLE BODY DOMAIN 15
  • A domain name is the only element

representing the source of a push message

DOMAIN localhost:8000
slide-16
SLIDE 16

Vulnerabilities We Found

  • The environments that do not display domains

⁻ Firefox on GNOME, Ubuntu MATE, Cinnamon, Budgie, and Pantheon ⁻ Samsung Internet, Firefox on Android

  • Causes phishing risks
16

Push without domain Push with domain

Chrome Firefox Samsung Internet
slide-17
SLIDE 17

I-II. Phishing risks of Third-Party Push Libraries

17
slide-18
SLIDE 18
  • Enable website owners to use push features
  • Provide useful features:

⁻ Scheduling push notifications, Reporting the statistics of subscribers, Supporting HTTP websites

Emerging Third-party Push Services

Image Source: https://sendpulse.com/features/webpush 18
slide-19
SLIDE 19

How push is Supported on HTTP Sites

19
slide-20
SLIDE 20

How push is Supported on HTTP Sites

20
slide-21
SLIDE 21

A css-styled permission dialog that is drawn by the library An actual permission dialog that a browser asks

How push is Supported on HTTP Sites

21
slide-22
SLIDE 22

An address of website that user visits A HTTPS domain that library creates

How push is Supported on HTTP Sites

Bounding

22
slide-23
SLIDE 23
  • A network attacker can redirect users to an attacker-controlled website
  • A visitor has no clue why she is redirected to a different domain

Permission Delegation Attack

NETWORK ATTACKER Powered by library Powered by Attacker

X

Allow http://benign.com to send notifications? 23
slide-24
SLIDE 24

I-III. Domain Name Spoofing Attack of Web Push Notifications

24
slide-25
SLIDE 25

Web Push in Detail

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Generated
endpoint URL returned
  • 4. The endpoint sent to the web server
  • 6. Push message
sent to the endpoint URL
  • 7. Push message sent to the browser
  • 5. The endpoint
stored
  • 8. Push message sent to
service worker
  • 1. Asks
Permission Yes 25
slide-26
SLIDE 26

Web Push in Detail

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Generated
endpoint URL returned
  • 4. The endpoint sent to the web server
  • 6. Push message
sent to the endpoint URL
  • 7. Push message sent to the browser
  • 5. The endpoint
stored
  • 8. Push message sent to
service worker
  • 1. Asks
Permission Yes 26 An example of endpointURL https://fcm.googleapis.com/fcm/send/dTb6ILBpUYs:A PA91bGX_Xa91bizHC-
  • l0qF9fj7f2u9lt3mExBdbhGsE0zCuXkPJioWDgo4wf1m
TfZYgqX_-sVWRabWqx3GB9XiA9hsUf- gVnwkkbD8oDLAUIhScYYrmeSZaricyZv3gq3hbzjh48Ad
slide-27
SLIDE 27

Web Push in Detail

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Generated
endpoint URL returned
  • 4. The endpoint sent to the web server
  • 6. Push message
sent to the endpoint URL
  • 7. Push message sent to the browser
  • 5. The endpoint
stored
  • 8. Push message sent to
service worker
  • 1. Asks
Permission Yes 27
slide-28
SLIDE 28

Web Push in Detail

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Generated
endpoint URL returned
  • 4. The endpoint sent to the web server
  • 6. Push message
sent to the endpoint URL
  • 7. Push message sent to the browser
  • 5. The endpoint
stored
  • 8. Push message sent to
service worker
  • 1. Asks
Permission Yes 28
slide-29
SLIDE 29

Web Push in Detail

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Generated
endpoint URL returned
  • 4. The endpoint sent to the web server
  • 6. Push message
sent to the endpoint URL
  • 7. Push message sent to the browser
  • 5. The endpoint
stored
  • 8. Push message sent to
service worker
  • 1. Asks
Permission Yes 29

The EndpointURL is confidential information!

slide-30
SLIDE 30

Web Push Protocol: VAPID

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. Send the endpoint and encryption key to the web server
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes

Public Key Private Key

  • Designed to authenticate web servers
  • Utilizes asymmetrical key pairs

⁻ Without a private key, cannot send push messages

30
slide-31
SLIDE 31

VAPID in the Wild

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. Send the endpoint and encryption key to the web server
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes Third-party Library VAPID SnedPulse X Izooto X Pushwoosh X Foxpush X OneSignal Pushcrew X Pushengage X Urbanairship 31
slide-32
SLIDE 32

Domain Spoofing Attack

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. The endpoint sent to the web server over HTTP
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes

NETWORK ATTACKER

32 A push with spoofed domain, “kirannewsagency.iz.do”
slide-33
SLIDE 33

Why Phishing via Web Push Matters?

  • Difficult to determine the origin of messages
  • An attacker can send push messages at any time

Real-world phishing

33
slide-34
SLIDE 34
  • II. User Privacy Leak via Offline Usage
34
slide-35
SLIDE 35

History Sniffing Attack

  • Critical privacy threat

⁻ E. Felten at al., Timing Attacks on Web Privacy [CCS 2000] ⁻ Z. Weinberg at al., I Still Know What You Visited Last Summer: Leaking Browsing History via User Interaction and Side Channel Attacks [S&P 2011] ⁻ S. Son at al., What Mobile Ads Know About Mobile Users [NDSS 2016]

  • Can leak personal information
35
slide-36
SLIDE 36

History Sniffing Attack on PWAs

  • A new side channel attack that exploits Cache
36
slide-37
SLIDE 37

History Sniffing Attack on PWAs

  • A new side channel attack that exploits Cache
  • How it works:
https://attacker-pwa.com iframe of target 1 iframe of target 2 37
slide-38
SLIDE 38

History Sniffing Attack on PWAs

  • A new side channel attack that exploits Cache
  • How it works:
iframe of target 1 iframe of target 2 https://attacker-pwa.com
  • 1. A victim opens the attacking PWA offline
38
slide-39
SLIDE 39

History Sniffing Attack on PWAs

  • A new side channel attack that exploits Cache
  • How it works:
iframe of target 1 iframe of target 2
  • 1. A victim opens the attacking PWA offline
  • 2. An onload event will only be triggered

if victims have visited target PWAs

https://attacker-pwa.com Onload event handler Onload event handler 39
slide-40
SLIDE 40

History Sniffing Attack on PWAs

  • A new side channel attack that exploits Cache
  • How it works:
iframe of target 1 iframe of target 2

Advantages: 1) Accuracy 2) No outgoing requests

https://attacker-pwa.com
  • 1. A victim opens the attacking PWA offline
  • 2. An onload event will only be triggered

if victims have visited target PWAs

Onload event handler Onload event handler 40
slide-41
SLIDE 41

Consequences of History Sniffing Attack

  • Vulnerable Browser: Firefox 59.0.2
  • X-Frame-Options, CSP, and Frame Busting are effective to defense
  • Safari manages cache separately from the first-party
Offline Cache Attack # of Websites Vulnerable 187 (36.5%) Not Vulnerable X-Frame-Options 132 (25.7%) CSP 22 (4.3 %) Frame Busting 10 (1.9%) Others 162 (31.6%) Total 513 (100%) 41
slide-42
SLIDE 42
  • III. Cryptocurrency Mining Attack

Using Service Worker

42
slide-43
SLIDE 43

Cryptocurrency Mining in the Web

  • CoinHive is a popular JavaScript cryptocurrency mining service
  • Main Limitation:

⁻ Stops when user leaves

COINHIVE 43
slide-44
SLIDE 44

Cryptocurrency Mining Attack

  • CoinHive is a popular JavaScript cryptocurrency mining service
  • Main Limitation:

⁻ Stops when user leaves

  • Introducing cryptocurrency mining attack using Service Worker
SERVICE WORKER COINHIVE 44

Advantages: 1) Stealthy 2) Lasting Longer

slide-45
SLIDE 45

Cryptocurrency Mining Attack

  • Technical challenges:

⁻ Service Worker becomes idle ⁻ Service Worker cannot use WebSocket

45
slide-46
SLIDE 46

Cryptocurrency Mining Attack

  • Technical challenges:

⁻ Service Worker becomes idle ⁻ Service Worker cannot use WebSocket

  • Solution:

⁻ Push notifications

46
slide-47
SLIDE 47

Cryptocurrency Mining Attack

  • Two tricks:

⁻ Non-visible push ⁻ Re-subscription

  • Different browsers have different policies:
Whale Brave Samsung Internet Opera Chrome Edge Firefox Non-visible push X X X X X Re-subscription in the background
  • X
47 A warning sign if push API is not called

Most stealthy!

slide-48
SLIDE 48

Cryptocurrency Mining Results

  • Mined Monero coins for 24 hours using a single service worker
  • The more victims, the more lucrative this attack is
Browser Environment Number of Solved Hashes (24h) Amount of Monero (24h) Chrome 65 Window 10 Desktop (3.6GHz Intel Core i7, 16GB) 225,024 0.00001266 Firefox 69 Window 10 Desktop (3.6GHz Intel Core i7, 16GB) 195,840 0.00001119 Chrome 65 Android 8.0 Google Pixel 50,176 0.00000282 Chrome 65 macOS High Sierra 10.13.4 (1.3GHz Intel Core i5, 8GB) 138,496 0.00000778 48
slide-49
SLIDE 49

Lessons Learned

  • Web Push requires careful use

⁻ adopt VAPID ⁻ treat EndpointURL as confidential information

  • Well known defenses are helpful
  • Better design for supporting web push for HTTP websites is Required
49
slide-50
SLIDE 50

Conclusion

  • The first in-depth study of PWAs
  • Proposed novel attacks that abuse fundamental features of PWAs
  • Provided mitigating recommendations
  • Reported findings to corresponding vendors
  • All demonstrations can be found at

https://github.com/spostman/ppp-ccs2018

50
slide-51
SLIDE 51

Thank You!

Q&A

51
slide-52
SLIDE 52

Consequences of Permission Delegation Attack

Third-party Library Attack Success Number of affected HTTP sites SnedPulse 93 Izooto 18 Pushwoosh 4 Foxpush 1 OneSignal X 528 Pushcrew X 31 Pushengage X 19 Urbanairship X 2 A permission delegation attack against http://www.koimoi.com 52
slide-53
SLIDE 53

Domain Spoofing Attack Implication

Third-party Library Attack Success Number of affected HTTP sites SnedPulse 93 Izooto 18 Pushwoosh 4 Foxpush X 1 OneSignal X 528 Pushcrew X 31 Pushengage X 19 Urbanairship X 2 A push with spoofed domain, “kirannewsagency.iz.do” A push with spoofed domain, “afn.sendpulse.com” 53
slide-54
SLIDE 54

Web Push Protocol: VAPID

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. Send the endpoint and encryption key to the web server
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes Public Key Private Key 54
slide-55
SLIDE 55

Web Push Protocol: VAPID

SERVICE WORKER PUSH SERVER WEB SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. Send the endpoint and encryption key to the web server
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes Public Key Private Key 55
slide-56
SLIDE 56

Domain Spoofing Attack

SERVICE WORKER PUSH SERVER THIRD-PARTY SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. Send the endpoint and encryption key to the web server
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes GET script.js Script.js is sent 56
slide-57
SLIDE 57

Domain Spoofing Attack

SERVICE WORKER PUSH SERVER THIRD-PARTY SERVER

  • 2. Subscribe to
push service
  • 3. Get generated
endpoint and encryption key
  • 4. Send the endpoint and encryption key to the web server
  • 6. Send the
encrypted payload to the endpoint
  • 7. Payload received on the URL is
sent to the browser
  • 5. Store the
endpoint and encryption keys
  • 8. The payload is decrypted
and sent to the service worker
  • 1. Permission
asking Yes GET script.js Script.js is sent over HTTP var n=“ https://pushdata.sendpulse.com "; var n=“ https://attacker.server.com ";

NETWORK ATTACKER

57 A push with spoofed domain, “afn.sendpulse.com”