PathCutter: Severing the Self-Propagation Path of XSS JavaScript Worms in Social Web Networks.

摘要: Worms exploiting JavaScript XSS vulnerabilities rampantly infect millions of web pages, while drawing the ire helpless users. To date, users across all popular social networks, including Facebook, MySpace, Orkut and Twitter, have been vulnerable to worms. We propose PathCutter as a new approach severing self-propagation path works by blocking two critical steps in propagation an worm: (i) DOM access different views at client side (ii) unauthorized HTTP request server. As result, although vulnerability is successfully exercised client, worm prevented from propagating would-be victim’s own network page. effective against current forms worms, those that exploit traditional XSS, DOM-based content sniffing vulnerabilities. present evaluate both server-side proxyside deployment PathCutter. implement on WordPress Elgg demonstrate its resilience proof-of-concept attacks. also implementation five real-world worms: Boonana, MySpace Samy, Renren, SpaceFlash, Yamanner worm. show worms themselves vulnerabilities, either or server side, they are thwarted it agnostic blocks infection. Our performance evaluation shows rendering overhead less than 4%, memory for one additional view 1%.