Search

Depending on manual solutions for finding security vulnerabilities in web applications is time-consuming, error-prone, and requires high levels of expertise. This paper proposes a model for an automated extension-based penetration testing for web vulnerabilities that is compatible with any web application. It consists of three stages that start with information gathering, followed by a vulnerability assessment process to test for exploit. The results are then automatically generated as a report at the conclusion. To examine the model, a tool is developed based on the suggested model. Results demonstrate that the proposed technique has effectively and promptly identified application's vulnerabilities. [ABSTRACT FROM AUTHOR]

This paper focuses on a very pertinent issue in the field of cybersecurity, particularly concerning the increased use of public Wi-Fi and the proliferation of IoT devices. The scenario, where an attacker captures user details through a malicious access point set up through a NodeMCU, is a practical illustration of a Man-in-the-Middle (MitM) attack. These attacks are especially concerning in the context of smart homes and smart cities, where security breaches can lead to severe privacy invasions and disruptions of essential services. The NodeMCU, being a low-cost, open-source IoT platform, is accessible for creating such malicious access points. It can be programmed to mimic legitimate Wi-Fi hotspots to intercept the data of unsuspecting users. This type of attack can enable unauthorized access to sensitive information such as login credentials, personal data, and even control over connected IoT devices. This approach is user-friendly and can significantly reduce the risk of users unknowingly connecting to malicious websites. The contribution of this paper includes a demonstration and analysis of a common network and IoT attack and a novel method for detecting fraudulent URLs, particularly those used in phishing attacks. By addressing these aspects, the paper makes a significant contribution to the field of cybersecurity and helps foster a more secure and resilient network and IoT ecosystem. [ABSTRACT FROM AUTHOR]

One of the most common attacks in browser extensions is Cross-site scripting (XSS). To address these challenges, several browsers have proposed a new mechanism where legitimate browser extensions can only be installed from their respective Web Stores. Nonetheless, this mechanism is not flawless and multiple users still choose to install browser extensions from other sources, leaving them exposed to multiple types of attacks. This paper proposes a browser extension capable of detecting XSS attacks using Machine Learning (ML), as well as other irregularities that may occur in recently installed browser extensions. Regarding the detection of XSS attacks, the detection model is based on the Support Vector Machine (SVM) and it was able to detect malicious scripts with an accuracy of 99.5%, a precision of 99.4%, and a recall of 99.0%. Additionally, the detection of two other types of irregularities, namely the presence of blacklisted or irregular URLs located in the browser extension, and the presence of undesirable data in the manifest file of the browser extension, were considered. A Windows application was also designed in Java and deployed alongside the browser extension to monitor suspicious network requests from the newly installed browser extension. [ABSTRACT FROM AUTHOR]

Cyber security confronts a tremendous challenge of maintaining the confidentiality and integrity of user’s private information such as password and PIN code. Billions of users are exposed daily to fake login pages requesting secret information. There are many ways to trick a user to visit a web page such as, phishing mails, tempting advertisements, click-jacking, malware, SQL injection, session hijacking, man-in-the-middle, denial of service and cross-site scripting attacks. Web spoofing or phishing is an electronic trick in which the attacker constructs a malicious copy of a legitimate web page and request users’ private information such as password. To counter such exploits, researchers have proposed several security strategies but they face latency and accuracy issues. To overcome such issues, we propose and develop client-side defence mechanism based on machine learning techniques to detect spoofed web pages and protect users from phishing attacks. As a proof of concept, a Google Chrome extension dubbed as PhishCatcher, is developed that implements our machine learning algorithm that classifies a URL as suspicious or trustful. The algorithm takes four different types of web features as input and then random forest classifier decides whether a login web page is spoofed or not. To assess the accuracy and precision of the extension, multiple experiments were carried on real web applications. The experimental results show remarkable accuracy of 98.5% and precision as 98.5% from the trials performed on 400 classified phished and 400 legitimate URLs. Furthermore, to measure the latency of our tool, we performed experiments over forty phished URLs. The average recorded response time of PhishCatcher was just 62.5 milliseconds.

Although code review is an essential step for ensuring the quality of software, it is surprising that current code review systems do not have mechanisms to protect the integrity of the code review process. We uncover multiple attacks against the code review infrastructure which are easy to execute, stealthy in nature, and can have a significant impact, such as allowing malicious or buggy code to be merged and propagated to future releases. To improve this status quo, in this work we lay the foundations for securing the code review process. Towards this end, we first identify a set of key design principles necessary to secure the code review process. We then use these principles to propose SecureReview , a security mechanism that can be applied on top of a Git-based code review system to ensure the integrity of the code review process and provide verifiable guarantees that the code review process followed the intended review policy. We implement SecureReview as a Chrome browser extension for GitHub and Gerrit. Our security analysis shows that SecureReview is effective in mitigating the aforementioned attacks. An experimental evaluation shows that the SecureReview implementation only adds a slight storage overhead (i.e., less than 0.0006 of the repository size). [ABSTRACT FROM AUTHOR]

The development of digitization over the globe has made digital security inescapable. As every single article on this planet is being digitalized quickly, it is more important to protect those items. Numerous cyber threats effectively deceive ordinary individuals to take away their identifications. Phishing is a kind of social engineering attack where the hackers are using this kind of attack in modern days to steal the user's credentials. After a systematic research analysis of phishing technique and email scam, an intrusion detection system in chrome extension is developed. This technique is used to detect real-time phishing by examining the URL, domain, content and page attributes of an URL prevailing in an email and any web page portion. Considering the reliability, robustness and scalability of an efficient phishing detection system, we designed a lightweight and proactive rule-based incremental construction approach to detect any unknown phishing URLs. Due to the computational intelligence and nondependent of the blacklist signatures, this application can detect the zero-day and spear phishing attacks with a detection rate of 89.12% and 76.2%, respectively. The true positive values acquired in our method is 97.13% and it shows less than 1.5% of false positive values. Thus the application shows the precision level higher than the previous model developed and other phishing techniques. The overall results indicate that our framework outperforms the existing method in identifying phishing URLs. [ABSTRACT FROM AUTHOR]

A significant amount of research project funding is spent creating customized annotation systems, re-inventing the wheel once and again, developing the same common features. In this paper, we present WACline, a Software Product Line to facilitate customization of browser extension Web annotation clients. WACline reduces the development effort by reusing common features (e.g., highlighting and commenting) while putting the main focus on customization. To this end, WACline provides already implemented 111 features that can be extended with new ones. In this way, researchers can reduce the development and maintenance costs of annotation clients.

Browser fingerprinting refers to a collection of techniques used to gather information about a user's browser attributes. The information gained from a browser fingerprint can be used to partially or fully identify a user without using any other technique, e.g., cookies. One type of browser fingerprinting is canvas fingerprinting which utilizes HTML-canvas elements to identify users. Various defense algorithms against canvas fingerprinting have been developed, but unfortunately, have been shown to be penetrable and detectable. In this paper, we present Canvas Deceiver, a new countermeasure against canvas fingerprint. Canvas Deceiver is a browser extension that uses a new algorithm that is different from existing problem-possessing algorithms. Canvas Deceiver does not rely on randomness, does not provide a unique identity, and is not detectable. To show its functionality and effectiveness, we tested Canvas Deceiver using different tools that provide browser fingerprint tests. According to the test results, Canvas Deceiver outperforms current countermeasures in detectability while providing sufficient anonymity to its users. For instance, in Browserleaks, the user originally was put into a group with 634 people. After using Canvas Deceiver, he is put into a group with 7847 people.

Instant Messaging (IM) provides near-real-time communication between users, which has shown to be a valuable tool for internal communication in companies and for general-purpose interaction among people. IM systems and supporting protocols, however, must consider security aspects to guarantee the messages' authenticity, confidentiality, and integrity. In this paper, we present a solution for integrating hardware-based public key cryptography into Converse.js, an open-source IM client for browsers enabled with the Extensible Messaging and Presence Protocol (XMPP). The proposal is developed as a plugin for Converse.js, thus overriding the original functions of the client; and a browser extension that is triggered by the plugin and is responsible for calling the encryption and decryption services for each sent and received message. This integrated artifact allowed the experimental validation of the proposal providing authenticity of IM users with digital certificates and protection of IM messages with hardware-based cryptography. Results also shows the proposed systems is resistent to adversarial attacks against confidentiality and integrity and it is secure when considering cryptrographic tests like the Hamming distance and the NIST SP800-22.

Introduction: New approaches to the study of the binge-watching phenomenon require new technology, leading to the development of a non-intrusive and low-cost analytical research software that facilitates a holistic understanding of binge-watching in an uncontrolled environment remotely (e.g., the home). BWDAT was developed to allow the collection of three types of data: users’ physiological data gathered from a smartwatch, users’ interactions from video-on-demand interfaces, and self-reported data. This tool offers the possibility to generate automatic data analysis reports, facilitating researchers’ data analysis tasks. Methods: Two trial studies and a long-term study were used to evaluate the design and the technical implementation of the BWDAT tool. The metrics used were the BWDAT smartwatch’s App data coverage of the viewing sessions, and the data’s reliability of the viewer’s interactions with the Netflix interface, collected by the BWDAT Chrome Extension. Results: High percentages of data coverage and content coverage were verified in the sessions collecting the smartwatch’s data. The reporting system developed proved to be useful in the collection and synchronization of physiological and users’ interaction data with Netflix interface, both generated in uncontrolled environments. Furthermore, the BWDAT tool facilitated the analysis of a large amount of nuanced data. Conclusion: The results obtained confirm the reliability, accuracy, and usability of BWDAT. This tool has the potential to help researchers shed new light on the field of media and audience studies, and in particular on binge-watching.

In this paper, we summarize the latest social engineering phishing attack types with the focus on domain name manipulation. Providing a fake domain is a crucial part of phishing attacks that can be carried out with different techniques such as cybersquatting, typosquattings, or homographs. We argue that homographs with special International Domain Names can be very serious threat for many users that can hardly be identified. We present the analysis of phishing attacks with Arabic domains and conclude that because of the linguistic complexity of the Arabic language and the missing support by the industrial tools expose millions of users to sophisticated domain manipulation based phishing attacks. To reduce the future risk of homograph attacks originating from Arabic internationalized domain names (IDNs) we suggest a change to the registration policy. We also present a browser extension to assist against homographs in current Arabic IDN namespace. [ABSTRACT FROM AUTHOR]

Internet usage has grown dramatically since the early years of its inception. The rich field of data provided by internet users in interaction with digital media content can provide insight into web-based navigation behavior and underlying psychological dimensions. Human-computer interaction in the web is an underutilized source of data for understanding human online behavior. While researchers and usability testing services do use these sources to analyze human behavior and user experience, access to the diverse range of other potentially useful data available during web-based interaction for research is limited. In this paper, we propose a novel tool in the form of a web browser extension, referred to as Latent, which can be used to simultaneously capture information from different sources while users interact with digital content. The data acquisition capabilities of Latent makes it suitable for various research purposes, ranging from studies of usability to decision-making and personality. A particular advantage of Latent is that the method and control of data acquisition is completely transparent to the user. We present the architecture of the web browser extension, describe the data that can be acquired, and report on the residual impact of the tool on the user's computer processing resources.

Web-based Git hosting services such as GitHub and GitLab are popular choices to manage and interact with Git repositories. However, they lack an important security feature – the ability to sign Git commits. Users instruct the server to perform repository operations on their behalf and have to trust that the server will execute their requests faithfully. Such trust may be unwarranted though because a malicious or a compromised server may execute the requested actions in an incorrect manner, leading to a different state of the repository than what the user intended. In this paper, we show a range of high-impact attacks that can be executed stealthily when developers use the web UI of a Git hosting service to perform common actions such as editing files or merging branches. We then propose le-git-imate , a defense against these attacks, which enables users to protect their commits using Git's standard commit signing mechanism. We implement le-git-imate as a Chrome browser extension. le-git-imate does not require changes on the server side and can thus be used immediately. It also preserves current workflows used in Github/GitLab and does not require the user to leave the browser, and it allows anyone to verify that the server's actions faithfully follow the user's requested actions. Moreover, experimental evaluation using the browser extension shows that le-git-imate has comparable performance with Git's standard commit signature mechanism. With our solution in place, users can take advantage of GitHub/GitLab's web-based features without sacrificing security, thus paving the way towards verifiable web-based Git repositories. [ABSTRACT FROM AUTHOR]

In this paper, we address an unsolved problem in the real world: how to ensure the integrity of the web content in a browser in the presence of malicious browser extensions? The problem of exposing confidential user credentials to malicious extensions has been widely understood, which has prompted major banks to deploy two-factor authentication. However, the importance of the "integrity" of the web content has received little attention. We implement two attacks on real-world online banking websites and show that ignoring the "integrity" of the web content can fundamentally defeat two-factor solutions. To address this problem, we propose a cryptographic protocol called DOMtegrity to ensure the end-to-end integrity of the DOM structure of a web page from delivering at a web server to the rendering of the page in the user's browser. DOMtegrity is the first solution that protects DOM integrity without modifying the browser architecture or requiring extra hardware. It works by exploiting subtle yet important differences between browser extensions and in-line JavaScript code. We show how DOMtegrity prevents the earlier attacks and a whole range of man-in-the-browser attacks. We conduct extensive experiments on more than 14,000 real-world extensions to evaluate the effectiveness of DOMtegrity. [ABSTRACT FROM AUTHOR]

Portable document format (PDF) electronic files are by far the most popular format used to publish, store, and share scholarly journal articles. Recently, new tools for quickly finding and linking to journal article PDFs have been developed. These tools integrate into the researcher's web browser and scan for unique identifiers associated with a journal article. When a unique identifier is found, the tool attempts to locate a PDF copy of the associated article and provide a link. This article will explore how these full-text finders work and discuss the advantages and disadvantages of these tools. Descriptions of several of the most popular tools are provided, and a short discussion of how librarians can facilitate the use of these tools at their institutions is included. [ABSTRACT FROM AUTHOR]