| Speaker: | Dr. Helen Jiahe Wang ,Microsoft Research |
|---|---|
| Abstract: | Vulnerability-driven filtering of network data can offer a fast and easy-to-deploy alternative or intermediary to software patching, as exemplified in Shield. This approach provides protection for the time window between patch release and patch application. This time window is critical because attackers often reverse engineer newly released patches to gain vulnerability knowledge and then launch attacks against unpatched machines. In this paper, we take Shield's vision to a new domain, inspecting and cleansing not just static content, but also dynamic content. The dynamic content we target is the dynamic HTML in web pages, which have become a popular vector for attacks. The key challenge in filtering dynamic HTML is that it is undecidable to statically determine whether an embedded script will exploit the browser at run-time. We avoid this undecidability problem by rewriting web pages and any embedded scripts into safe equivalents, inserting checks so that the filtering is done at run-time. The rewritten pages contain logic for recursively applying run-time checks to dynamically generated or modified web content, based on known vulnerabilities. We have built and evaluated {\it BrowserShield}, a system that performs this dynamic instrumentation of embedded scripts, and that admits policies for customized run-time actions, such as vulnerability-driven filtering. |
| Biography: | Helen J. Wang is a researcher in the Systems and Networking research group at Microsoft Research, Redmond, WA. She leads the Shield research project. Her research interests are in system/network security, networking, protocol architectures, mobile/wireless computing, and wide-area large scale distributed system design. She received her Ph.D. degree from the Computer Science department of U. C. Berkeley in December, 2001. Her Ph.D. thesis was on "Scalable, robust wide-area control architecture for integrated communications". Helen obtained her Bachelor of Science in Computer Science from U. T. Austin, and Master of Science in Computer Science from U. C. Berkeley. |
| Presentation On: | Wednesday,3 May, 2006, 11:00 a.m. in room 1115, CSIC |
| Videotape: | |
