We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Protecting Websites from Shared Code

New browser software can protect websites from software vulnerabilities.

The ease with which websites can share code is both a blessing and a curse for today’s Internet. It allows for powerful Web applications that pull a wide variety of data and services together. But it also puts a site at the mercy of code written by third parties–code that may have security vulnerabilities, or may prove problematic in combination with the rest of what’s offered by a site.

A new browser extension would allow developers to use third-party code without worrying about the vulnerabilities that such code might open up. A pair of researchers described this extension, called ConScript, in a talk given this week at the IEEE Symposium on Security and Privacy in Oakland, CA.

Modern websites can be “a little disturbing if we look under the hood,” says Leo Meyerovich, a researcher at the University of California, Berkeley, who was involved with the work. To demonstrate, he showed how the local business review site Yelp also runs JavaScript from Facebook, Google Analytics, and a company called Scorecard Research.

In many cases, Meyerovich says, this is a “benign but buggy situation.” When a problem does arise, he says, it’s often hard to see clearly who’s to blame–the service running the third-party code, or the code itself. This also makes it hard to fix problems.

With ConScript, the researchers hope to sidestep this issue by giving developers and site owners an easier way to control what third-party code on their sites can do.

ConScript requires adding a relatively small amount of code to the browser (about 1,000 lines). This code then examines JavaScript commands that are being processed by the browser. It will inject extra code that prevents the JavaScript from attempting tasks that the user has configured it to block.

Ben Livshits, a researcher from Microsoft Research who was also involved with the work, notes that ConScript provides a way for developers and browser manufacturers to advance the ways that sites use JavaScript without compromising security in the process. The system is designed to be flexible, reliable, and lightweight way to enforce good security practices.

ConScript knows what behavior to enforce based on a set of policies chosen by the owner of a website. For example, a site owner might set the system so that untrusted code is never allowed to introduce pop-ups or direct the user to other websites. The researchers designed Conscript so that the owner of a website can choose these policies in several ways–by writing policies themselves, by choosing policies from a library of possibilities, or by generating them automatically based on analysis of the code of the website.

One advantage of ConScript’s design, Meyerovich says, is that it should allow developers to use older code without having to alter it, even if it contains known security vulnerabilities. This is important not only for new websites but also to allow users to safely access existing websites that aren’t being kept up-to-date. If the policies are well-designed and carefully selected, the researchers say, they shouldn’t interfere with any of a site’s intended functionality.

The researchers tested their system with several popular Web services, including Google Maps, MSN, Gmail, Live Desktop, and Google Calendar. They found that they were able to deploy their system without significantly slowing down these sites, a big concern for any system designed to protect against untrusted code.

Engin Kirda, a professor of computer science at Institute Eurecom in France, says that ConScript “is a very useful system. If it really gets integrated into the browser and people start using it, it will make the Internet much safer.”

Meyerovich says it would be technically straightforward to create ConScript extensions for all major browsers. However, he admits that that establishing ConScript as a standard, so that all browser makers actually do this, could prove complicated.

Couldn't get to Cambridge? We brought EmTech MIT to you!

Watch session videos here
Want more award-winning journalism? Subscribe to Insider Plus.
  • Insider Plus {! insider.prices.plus !}*

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    Print + Digital Magazine (6 bi-monthly issues)

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

    Technology Review PDF magazine archive, including articles, images, and covers dating back to 1899

    10% Discount to MIT Technology Review events and MIT Press

    Ad-free website experience

You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.