Search: onr:"swepub:oai:DiVA.org:mdh-55914" >
SandTrap :
SandTrap : Securing javascript-driven trigger-action platforms
-
- Ahmadpanah, Seyed Mohammad Mehdi, 1996 (author)
- Chalmers University of Technology, Sweden,Chalmers Univ Technol, Gothenburg, Sweden.,Chalmers tekniska högskola
-
- Hedin, Daniel (author)
- Mälardalens högskola,Inbyggda system,Chalmers University of Technology, Sweden,Chalmers Univ Technol, Gothenburg, Sweden.;Mälardalen Univ, Västerås, Sweden.,Chalmers tekniska högskola
-
- Balliu, Musard (author)
- KTH,Teoretisk datalogi, TCS,KTH Royal Institute of Technology, Sweden,Chalmers tekniska högskola,Chalmers University of Technology
-
show more...
-
- Olsson, L. E. (author)
- Chalmers University of Technology, Sweden,Chalmers Univ Technol, Gothenburg, Sweden.,Chalmers tekniska högskola
-
- Sabelfeld, Andrei, 1974 (author)
- Chalmers University of Technology, Sweden,Chalmers Univ Technol, Gothenburg, Sweden.,Chalmers tekniska högskola
-
show less...
-
Chalmers University of Technology, Sweden Chalmers Univ Technol, Gothenburg, Sweden (creator_code:org_t)
- ISBN 9781939133243
- USENIX Association, 2021
- 2021
- English.
-
In: Proceedings of the 30th USENIX Security Symposium. - : USENIX Association. - 9781939133243 ; , s. 2899-2916
- Related links:
-
https://research.cha... (primary) (free)
-
show more...
-
https://urn.kb.se/re...
-
https://urn.kb.se/re...
-
https://research.cha...
-
show less...
Abstract
Subject headings
Close
- Trigger-Action Platforms (TAPs) seamlessly connect a wide variety of otherwise unconnected devices and services, ranging from IoT devices to cloud services and social networks. TAPs raise critical security and privacy concerns because a TAP is effectively a “person-in-the-middle” between trigger and action services. Third-party code, routinely deployed as “apps” on TAPs, further exacerbates these concerns. This paper focuses on JavaScript-driven TAPs. We show that the popular IFTTT and Zapier platforms and an open-source alternative Node-RED are susceptible to attacks ranging from exfiltrating data from unsuspecting users to taking over the entire platform. We report on the changes by the platforms in response to our findings and present an empirical study to assess the implications for Node-RED. Motivated by the need for a secure yet flexible way to integrate third-party JavaScript apps, we propose SandTrap, a novel JavaScript monitor that securely combines the Node.js vm module with fully structural proxy-based two-sided membranes to enforce fine-grained access control policies. To aid developers, SandTrap includes a policy generation mechanism. We instantiate SandTrap to IFTTT, Zapier, and Node-RED and illustrate on a set of benchmarks how SandTrap enforces a variety of policies while incurring a tolerable runtime overhead.
Subject headings
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Datorsystem (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Computer Systems (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
Keyword
- Access control
- Access control policies
- Cloud services
- Empirical studies
- Open sources
- Policy generation
- Runtime overheads
- Security and privacy
- Third parties
- High level languages
Publication and Content Type
- ref (subject category)
- kon (subject category)
Find in a library
To the university's database