Security and Privacy Mechanisms for Web and Third-party Applications

Open Access
Xu, Wei
Graduate Program:
Computer Science and Engineering
Doctor of Philosophy
Document Type:
Date of Defense:
May 02, 2013
Committee Members:
  • Sencun Zhu, Dissertation Advisor
  • Sencun Zhu, Committee Chair
  • Guohong Cao, Committee Member
  • Heng Xu, Committee Member
  • David Miller, Committee Member
  • Lee David Coraor, Committee Member
  • Web application
  • third-party application
  • OSN worm
  • obfuscated JavaScript
  • Android permission
Web and third party applications are new forms of computer applications that heavily leverage the Internet and are compatible with various platforms such as PCs, tablets and smartphones. These applications are rapidly growing and are widely deployed. Many functionalities provided by these applications have been frequently used as alternatives to traditional host-based computer programs. A large user base reflects the unprecedented popularity of these applications. Unfortunately,the popularity of Web and third party applications has also drawn the attention of attackers, who exploit the vulnerabilities within these applications and pose great security and privacy threats to the users. To defend against these threats, this dissertation proposes several security defense and privacy protection mechanisms for Web and third party applications. The mechanisms proposed in this dissertation focus on two most popular platforms, i.e., Web browsers and smartphones. On each platform, different approaches are developed to protect users from the most severe and the most representative threats observed in the real world. The two most representative types of threats on Web browsers are JavaScript-based malicious Web pages and worm propagation in online social networks. As the top Internet security threat in recent years, malicious JavaScript code often applies obfuscation techniques to hide its malicious purpose and to evade the detection of anti-virus software. To this end, we proposed an approach called JStill that can detect and prevent the execution of the obfuscated malicious JavaScript code in Web browsers. The propagation of worms in online social network websites such as Facebook is new attack vector. Attackers leverage social connections and social engineering in online social networks to facilitate the propagation of worms. Given the new features in the propagation of worms, we proposed an early warning detection system that can detect worms in online social networks when only a small number of user accounts are infected. Android is the most popular smartphone operating system. Android system enforces an installation-time permission check mechanism, which can not effectively prevent sensitive permissions from being granted to malicious applications. In view of this issue, we propose Permlyzer, a framework to automatically generate analysis on the use of permissions in applications. The information obtained by Permlyzer can not only help users to make informed decision before installation, but also help application vendors to vet applications before releasing to the public.