Researchers from the Technical University of Vienna and Università Ca & # 39; Foscari Venezia have developed a plug-in designed to ensure the safe execution of weblogs to the browser. WPSE was first introduced at the 27th Usenix Security Symposium in Baltimore, a conference on system security.
According to the scientists, the plug-in can protect web apps against a large number of web attacks and incorrect protocol implementations. As concrete examples they call attacks on OAuth 2.0 and SAML 2.0. In addition, WPSE was able to identify vulnerabilities in more than 60 percent of the sites during an experimental site assessment. Among them there were new critical vulnerabilities, such as by following librarieswere introduced – all recoverable by WPSE.
The computer scientist Matteo Maffei from the Institute for Logic and Computation of the Technical University of Vienna, who is involved in the development, mainly points to the protection of logging in using social media accounts. "Logging into the internet using social media accounts has become very common," he quotes in a press release. "You can sign up for Instagram via the Facebook account or on various online forums from blogs or online magazines."
At the same time the relevant website, on which you want to log in, receives data directly from Facebook orHowever, it is not clear which programs are still running on this website and can initiate dangerous actions. For example, access data for social media used for authentication can be used illegally to extract additional information: "The attacking program can then access personal data, query lists from friends or even find out which pages I've visited. the worst case can even take over my social media account. "
The browser extension WPSE sees Maffei as an effective barrier between malicious scripts and the browser. "When you authenticate, Facebook gets a code that you then use to log in to the third-party website," he explains. "Our plug-in replaces this code with a randomly generated replacement code, the real code is only used for communication with Facebook, while scripts on other websites only see the replacement code.The browser extension is the data channel in between.This makes it impossible for malicious scripts to illegally share data with Facebook. "
In addition, the task of the plug-in is to monitor the entire data transfer in the browser and from the browser: "The authentication protocols are precisely defined, so we know exactly which information should be exchanged in which order between browser and website. does not hold on to it, such as requesting a specific step in the verification sequence without carrying out the previous steps, it is illegal action that can be dangerous. "
A first implementation was performed by the research team as an extension for Chrome, but not yet in theWebshop is available. According to the University of Vienna, there is a discussion with manufacturers of web browsers to install the plug-in in the browser in the future.