Sidebuster: automated detection and quantification of side-channel leaks in web application development

A web application is a "two-part" program, with its components deployed both in the browser and in the web server. The communication between these two components inevitably leaks out the program's internal states to those eavesdropping on its web traffic, simply through the side channel features of the communication such as packet length and timing, even if the traffic is entirely encrypted. Our recent study shows that such side-channel leaks are both fundamental and realistic: a set of popular web applications are found to disclose highly sensitive user data such as one's family incomes, health profiles, investment secrets and more through their side channels. Our study also shows that an significant improvement of the current web-application development practice is necessary to mitigate this threat. To answer this urgent call, we present in this paper a suite of new techniques for automatic detection and quantification of side-channel leaks in web applications. O...

• Type: Conference
• Year: 2010
• Where: CCS
• Authors: Kehuan Zhang, Zhou Li, Rui Wang 0010, XiaoFeng Wang, Shuo Chen
• Keywords: CCS 2010, Popular Web Applications, Security Privacy, Side-channel Leak, Web Application