Adobe Flash is a rich Internet application platform. Flash applications are often deployed to the Web; The Flash Player plugin is installed on a large fraction of all Webconnected PCs. Flash provides a mechanism by which sites can opt in to more expressive information sharing regimes than the same-origin policy for JavaScript allows. A site that wishes to share its content can host a crossdomain policy file, crossdomain.xml, which lists sites authorized to access the sharing site’s content, or even a wildcard to allow all access. Because browsers will typically attach cookies to crossdomain URL requests made by the Flash Player plugin, a site that publishes a crossdomain policy effectively opts out from some of the confidentiality guarantees of the same-origin policy. In some cases, a misconfigured, overly permissive crossdomain policy can expose a site to attacks such as information disclosure or CSRF. In 2008, Jeremiah Grossman surveyed the crossdomain policies of the Alexa Top 500 sites and the sites of the Fortune 500, and found that 7% hosted crossdomain policy files allowing unrestricted access. In this paper, we repeat Grossman’s survey on a larger corpus of sites: the Alexa global Top 50,000 sites. In addition, we use an instrumented Firefox to survey the actual crossdomain requests issued by Flash content hosted on the front pages of the Alexa global Top 50,000 sites. Our survey provides new data about the use of Flash crossdomain policies on popular sites. For example, we find that approximately 6.0% of the surveyed sites allow unrestricted crossdomain access, including 12 sites in the Alexa Top 100, and that, at a minimum, 6.7% of crossdomain requests made by Flash applications we observed were denied by the target site’s crossdomain policy. Our findings suggest that Flash’s crossdomain policy mechanism may be liable to misconfiguration in practice. We propose some techniques for mitigating the security problems that might arise from such misconfiguration.
[1]
Jon A. Rochlis,et al.
With microscope and tweezers: the worm from MIT's perspective
,
1989,
Commun. ACM.
[2]
Elizabeth D. Zwicky,et al.
Building internet firewalls
,
1995
.
[3]
David Zhang,et al.
Secure program execution via dynamic information flow tracking
,
2004,
ASPLOS XI.
[4]
Dan Boneh,et al.
Protecting browsers from dns rebinding attacks
,
2007,
CCS '07.
[5]
C. Jackson,et al.
Beware of Finer-Grained Origins
,
2008
.
[6]
Collin Jackson,et al.
Robust defenses for cross-site request forgery
,
2008,
CCS.
[7]
Collin Jackson,et al.
Securing frame communication in browsers
,
2008,
CACM.
[8]
E. Chen,et al.
Talking to Yourself for Fun and Profit
,
2011
.
[9]
Evangelos P. Markatos,et al.
An empirical study on the security of cross-domain policies in rich internet applications
,
2011,
EUROSEC '11.