What is wrong?

Notice: Before sending an error with the download, please try the direct link first: Attacks Exploiting the HTML5 Screen Sharing API

Loading...

You must sign in to do that.

Forgot password?

Attacks Exploiting the HTML5 Screen Sharing API

Attacks Exploiting the HTML5 Screen Sharing API

Attacks Exploiting the HTML5 Screen Sharing API

Score: ---- | 0 votes
| Sending vote
| Voted!
|

Book Details:

pos
Global
pos
Category
Year:2014
Publisher:Carnegie Mellon University
Pages:15 pages
Language:english
Since:26/06/2014
Size:1.39 MB
License:Pending review

Content:

HTML5 changes many aspects in the browser world by introducing numerous new concepts; in particular, the new HTML5 screen sharing API impacts the security implications of browsers tremendously. One of the core assumptions on which browser security is built is that there is no cross-origin feedback loop from the client to the server. However, the screen sharing API allows creating a cross-origin feedback loop.

Consequently, websites will potentially be able to see all visible content from the user’s screen, irrespective of its origin. This cross-origin feedback loop, when combined with human vision limitations, can

introduce new vulnerabilities. An attacker can capture sensitive information from victim’s screen using the new API without the consensus of the victim. We investigate the security implications of the screen sharing API and discuss how existing defenses against traditional web attacks fail during screen sharing. We show that several attacks are possible with the help of the screen sharing API: cross-site request forgery, history sniffing, and information stealing. We discuss how popular websites such as Amazon and Wells Fargo can be attacked using this API and demonstrate the consequences of the attacks such as economic losses, compromised account and information disclosure. The objective of this paper is to present the attacks using the screen sharing API, analyze the fundamental cause and motivate potential defenses to design a more secure screen sharing API.

Categories:

Tags:

Loading comments...

Scanning lists...

The book in numbers

global rank

rank in categories

online since

26/06/2014

rate score

Nothing yet...

votes

Nothing yet...

Social likes

Nothing yet...

Views

Downloads

This may take several minutes

Interest

Countries segmentation

This may take several minutes

Source Referers

Websites segmentation

evolution

This may take several minutes

Loading...