Abstract
World Wide Web was brought to the fore in 1989 as the first version of HTML (HyperText Markup Language), accompanied with the capability of hypertext - a base format for publishing web pages. As the user types in a website’s address in the address bar of the browser, an HTTP request is initiated by the browser. The browser receives the response from the web server and builds a DOM (Document
Object Model), a data structure for storing information in a tree format. It then renders the content from the DOM into its window. Further, Image tag was proposed in 1993, which enabled web pages to
cascade requests thereby escalating security threats. The basic browser model, however, allows content inclusion from any server, and this prevails as a basic design flaw which has led to several malicious
attacks. Existing browser security policies like Same Origin Policy (SOP), Content Security Policy (CSP) do not mitigate these attacks by design.
On March 27, 2015, Github witnessed a massive DDoS attack, the largest in Github’s history till date which prevailed for over three days. In this incident, browsers and users were used as vectors to launch
the attack. This class of attack has affected many other websites on a large scale, such as Incapsula and CloudFlare. Upon detailed analysis, we found the primary cause of these attacks to be cross-origin request attacks (CORA). Given the fact that current browser security model does not prevent content inclusion cross-origin attacks, it is rather easy to launch such attacks. CORA is one of the top attacks in web security with CSRF (cross-site request forgery) attack ranking in the top 10 attacks (2017), by OWASP.
Against this compelling backdrop, this work undertakes a detailed analysis of CORP, a browser security policy which can be used to mitigate cross-origin request attacks. CORP enables a server to
control cross-origin interactions initiated by a browser. The browser intercepts the cross-origin requests and blocks the unwanted requests by the server. Further, we explain the outcome of this work in three
folds: Firstly, it demonstrates a compelling application of CORP in mitigating the browser-based DDoS attack, which has severely affected several websites in the past. Secondly, to gain a better understanding of CORP, we built a formal model of cross-origin request attacks and mitigated it using CORP. CORP has a client side dependency where users will have to use a CORP compliant browser to mitigate cross-origin attacks. Considering this, the concluding task was - implementation of CORP in Chromium source code.
To evaluate the effectiveness of CORP, we conducted several experiments on various cross-origin attacks. We simulated a browser-based DDoS attack in a lab environment and did a detailed analysis on mitigation of the attack using CORP. After that, we modelled a complex case of a cross-origin transaction, FIM (Federated Identity Management), and incorporated a malicious cross-origin attack in
it. We, then, validated CORP by mitigating the attack successfully using CORP. Modelling helped us in identifying the different parts involved in a CORP transaction. Thereon, to gain deeper insight into the functioning of CORP, we implemented CORP in Chromium browser and demonstrated the mitigation of various cross-origin attacks (CSRF, Clickjacking, cross-site timing attacks), present in websites hosted by top enterprises (such as facebook, google, twitter, dropbox, etc.), using CORP.