Effective Containment of Shared-Memory Application Extensions

Users are relying increasingly on untrusted software in their daily activities such as viewing documents and images, listening to music, watching video, communicating with others, playing games, and so on. This factor has prompted research in securing untrusted software, but much of this research has been focused on standalone applications, and hence don’t address the emerging trends towards shared-memory plug-ins and modules. Extensions such as browser plug-ins can access all of the memory of their host application. In addition, they can interact with their host application using application-specific as well as system-wide APIs consisting of thousands of functions. These factors make it very difficult to distinguish the actions of the extension from its host application, thus complicating efforts to selectively contain such extensions. Previous work has proposed to address this problem by limiting memory sharing, and by using small security-aware APIs, but they are cumbersome to apply to powerful extensions such as those used in browsers. In contrast, we develop a new approach that can distinguish operations made by the extension from those of its host. It enables policies that were originally developed for stand-alone untrusted applications to be applied more or less directly to plugins providing equivalent functionality. Underlying our approach is a fine-grained taint-tracking technique for binaries that uses sophisticated analysis and optimization techniques to achieve significantly better performance over previous works. 1