~/talk

Extension Breakdown...

on YouTube 25m
Talkat 26th USENIX Security Symposium (USENIX Security '17) · 2017-08-16..08-18· [web-platform, security]

speakers

name:Iskander Sanchez-Rola
links:none on file
name:Igor Santos
x:santos_igr
name:Davide Balzarotti
bluesky:balzarot.bsky.social

resources

video:https://youtu.be/DCHfiKbbyj8
slides:none on file

summary

Two new attacks bypass browser extension resource controls: a timing side‑channel against Chromium/Firefox access checks that a JavaScript PoC uses to enumerate installed extensions (authors claim 100% detection versus 10% for previous heuristics, tested on ~10,620 extensions), and a Safari leak where injected frames expose randomized URIs — static analysis of 721 Safari extensions flags 40.5% of Safari extensions as probably leaking identifiers. A 200‑person PoC shows this boosts fingerprinting entropy; vendors receive disclosures and proposed mitigations.

AI-written summary · about

chapters (8)

  1. 0:00Intro
  2. 0:19Extensions
  3. 1:23Resources Control Policies
  4. 2:50Access Control Settings
  5. 6:52URI Randomization
  6. 11:09Impact
  7. 15:10Vulnerability Disclosure
  8. 18:13Security Proposal

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.