"Puppetnets: Misusing Web Browsers as a Distributed Attack Infrastructure"
The recent ACM Conference on Computer and Communications Security (CCS'06) had some interesting papers. One of them deals with so called Puppetnets. A puppetnet is created by malicious web sites which exploit a visiting web browser and take control of it. Similar to a botnet, these puppetnets can be used to mount DDoS attacks, reconnaissance probes, or other nefarious purposes. Presumably the threat posed by these networks is way lower than botnets, but nevertheless they could pose a problem in the future due to the prevalance of client-side exploits. The whole paper is entitled "Puppetnets: Misusing Web Browsers as a Distributed Attack Infrastructure".
Abstract
Most of the recent work on Web security focuses on preventing attacks that directly harm the browser’s host machine and user. In this paper we attempt to quantify the threat of browsers being indirectly misused for attacking third parties. Specifically, we look at how the existing Web infrastructure (e.g., the languages, protocols, and security policies) can be exploited by malicious Web sites to remotely instruct browsers to orchestrate actions including denial of service attacks, worm propagation and reconnaissance scans. We show that, depending mostly on the popularity of a maliciousWeb site and user browsing patterns, attackers are able to create powerful botnet-like infrastructures that can cause significant damage. We explore the effectiveness of countermeasures including anomaly detection and more fine-grained browser security policies.
@inproceedings{DBLP:conf/ccs/LamAAA06,
author = {V. T. Lam and Spyros Antonatos and
P. Akritidis and Kostas G. Anagnostakis},
title = {Puppetnets: Misusing Web Browsers as a
Distributed Attack Infrastructure.},
booktitle = {ACM Conference on Computer and Communications Security (CCS'06)},
year = {2006},
pages = {221-234},
}
Abstract
Most of the recent work on Web security focuses on preventing attacks that directly harm the browser’s host machine and user. In this paper we attempt to quantify the threat of browsers being indirectly misused for attacking third parties. Specifically, we look at how the existing Web infrastructure (e.g., the languages, protocols, and security policies) can be exploited by malicious Web sites to remotely instruct browsers to orchestrate actions including denial of service attacks, worm propagation and reconnaissance scans. We show that, depending mostly on the popularity of a maliciousWeb site and user browsing patterns, attackers are able to create powerful botnet-like infrastructures that can cause significant damage. We explore the effectiveness of countermeasures including anomaly detection and more fine-grained browser security policies.
@inproceedings{DBLP:conf/ccs/LamAAA06,
author = {V. T. Lam and Spyros Antonatos and
P. Akritidis and Kostas G. Anagnostakis},
title = {Puppetnets: Misusing Web Browsers as a
Distributed Attack Infrastructure.},
booktitle = {ACM Conference on Computer and Communications Security (CCS'06)},
year = {2006},
pages = {221-234},
}
".
