Detecting In-Flight Page Changes with Web Tripwires

CSE Home

Security and Privacy

About Us

Search

Contact Info

Detecting In-Flight Page Changes with Web Tripwires

Overview

With our measurement tool, we found that approximately 1% of 50,000 visitors received pages that had been changed "in-flight." Most of these changes were caused by software that users installed on their computer (such as personal firewalls or ad blockers), but many were caused by agents in the network, such as ISPs and enterprise firewalls. Worse, we found that many of the products that users installed introduced bugs or security vulnerabilities into the web pages they requested.

To address this problem, publishers could choose to serve their pages over HTTPS rather than HTTP, using encryption to preserve page integrity. However, this is an expensive solution in many respects, so we offer an alternative integrity check. We propose that publishers deploy web tripwires to detect changes to their web pages. A web tripwire is JavaScript code that can detect textual changes to an HTTP web page, with the ability to report any changes to the user and to the publisher.

The rest of this page provides more information about the results of our measurement study, and how you can use web tripwires on your own web pages. Further details about the study are available in several forms:

• Our NSDI 2008 paper, entitled Detecting In-Flight Page Changes with Web Tripwires (PDF).
• Our talk slides (PDF) and poster (PDF) from our department's Industrial Affiliates Meeting.
• Our downloadable web tripwire toolkit and web tripwire service.

Detecting Page Changes

More information about how the web tripwire works can be found on the page linked above. At a basic level, it detects most textual changes to the page's HTML. It is not triggered by browser extensions (which are part of the browser), but it will detect proxy software installed on the user's computer. It is also not secure: adversaries could tamper with or remove the web tripwire if they wish to avoid detection. In most current cases, however, it will detect any changes to the page.

Measurement Study

Results

We were surprised to find that clients at 657 of those IP addresses (1.3%) reported some in-flight change to our page. This is a much larger number of changes than we expected. The vast majority of changes were caused by proxy software on the user's machine, such as popup blockers and ad blockers. However, we also observed ISPs that injected ads (e.g., through companies like NebuAd), enterprise firewalls that removed meta tags and inserted JavaScript security checks (e.g., with products like BlueCoat Web Filter), and malware that injected either exploit code or ads. Our findings are summarized in the table below.

Category	IPs	Examples
Popup Blocker	277	Zone Alarm (210), CA Personal Firewall (17), Sunbelt Popup Killer (12)
Ad Blocker	188	Ad Muncher (99), Privoxy (58), Proxomitron (25)
Problem in Transit	118	Blank Page (107), Incomplete Page (7)
Compression	30	bmi.js (23), Newlines removed (6), Image Distillation (1)
Security or Privacy	17	Blue Coat (15), The Cloak (1), AnchorFree (1)
Ad Injector	16	MetroFi (6), FairEagle/NebuAd (5), LokBox (1), Front Porch (1), PerfTech (1), Edge Technologies (1)
Meta Tag Changes	12	Removed meta tags (8), Reformatted meta tags (4)
Malware	3	W32.Arpiframe (2), Adware.LinkMaker (1)
Miscellaneous	3	New background color (1), IE Mark of the Web (1)

This table shows the categories of observed page changes, the number of client IP addresses affected by each, and examples. Each example is followed by the number of IP addresses that reported it; examples listed in bold introduced bugs or vulnerabilities into our page.

These changes were made by agents that had incentives to change the page, but their goals were not always in line with the goals of the user or the publisher. For example:

• ISPs sought to increase revenue from ads. These ads could annoy the user or dilute the impact of the publisher's own ads.
• Enterprise proxies sought to reduce traffic by removing cache-related meta tags, which could affect whether a user sees a stale copy of the page.
• Users sought to remove annoyances like popups and ads, which may affect the publisher's revenue stream.
• Malware authors sought to spread worms and make money off injected ads.

We found that many in-flight changes inadvertently broke web pages. For example, both CA Personal Firewall and some ISP-based changes caused a JavaScript stack overflow error when the scripts they inserted interfered with the code on our page. CA Personal Firewall also interfered with many web forums, including MySpace. MySpace users would post blog entries and comments, and they would find popup blocking code (i.e., "_popupControl()") inadvertently injected into their post.

Worse than this, we found several types of page changes that caused our page to become vulnerable to a cross site scripting (XSS) attack. Products such as Ad Muncher and the Sidki and Grypen filter sets for Proxomitron introduced code that was vulnerable to attack. These vulnerabilities were significant because they affected most or all of the web pages that a user visited. In the case of Proxomitron (but not Ad Muncher), the vulnerabilities could affect HTTPS traffic as well. This type of problem is analogous to a root exploit for an operating system, because it can potentially affect all pages that a user visits.

In these cases, an attacker could convince a user to follow a link that injected script code into almost any web page. This script code could steal a user's session cookie (e.g., on Facebook), modify login forms to steal passwords (e.g., on many banks), or manipulate the contents of any page (e.g., search results on Google).

We have reported the vulnerabilities we found, and the developers have released versions that fix the vulnerabilities as of Fall 2007. If you are using older versions of the products above, be sure to update as soon as possible.

Overall, these problems indicate that web page rewriting software can have dangerous consequences if it is not carefully analyzed. Users should understand these consequences when using web proxies.

Web Tripwire Toolkit

To make web tripwires easy to deploy, we have developed a configurable toolkit that can be hosted by a web publisher. The toolkit is available under a BSD-style open source license, and it is effective for most web pages with static content. It consists of two Perl CGI scripts that integrate web tripwires into a given web page.

Download Web Tripwire Toolkit

Web Tripwire Toolkit License

Copyright (c) 2007 Charles Reis
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
3. Neither the name of the University of Washington nor the names of
   its contributors may be used to endorse or promote products derived
   from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Toolkit Examples

Two examples of pages that use the toolkit are linked below.

• This page has a live web tripwire. It will only be noticeable to the user if the page is modified in flight.
• This page simulates a page that has been changed in flight, so that you can see how the web tripwire reports a change to the user.

Our original measurement tool at http://vancouver.cs.washington.edu also provides an example of web tripwires. This tool records any detected changes for use in our study. We encourage users to visit this page periodically to detect changes to their own web page requests.

Web Tripwire Service

Much like Google Analytics, we offer a JavaScript file that publishers can add to their own page. This requires a one-line change to a web page that causes browsers to fetch an active web tripwire from our server. The web tripwire will detect in-flight modifications to the page, report them to our server, and optionally display a message to the user. We can then log the changes and provide reports to the publisher.

To use our web tripwire service, just follow these steps:

1. Add the following line to your web page, replacing YOUR_URL with the full URL to your page. (Note that your web page must be static, such that two back-to-back requests for the page will receive identical contents.)
   <script src="http://vancouver.cs.washington.edu/service/webtripwire.cgi?page=YOUR_URL"></script>
2. (Optional) If you would not like a message to be displayed to your visitors when a modification is detected, add silentmode=1& after the ? in the above line.
3. Contact us to tell us your email address and the full URL to your page. We will only activate our service for your page once we verify that you have added the above line. (This step ensures that our service will not be misused as an open proxy.)
4. We will arrange to provide you with reports of what modifications were made to your page, as seen by your page's visitors.

Service Examples

Two examples of pages that use the service are linked below. These pages are hosted on a server that does not allow CGI scripts, so using the service is necessary.

• This page has a live web tripwire. It will only be noticeable to the user if the page is modified in flight.
• This page simulates a page that has been changed in flight, so that you can see how the web tripwire reports a change to the user.

	Computer Science & Engineering University of Washington Box 352350 Seattle, WA  98195-2350 (206) 543-1695 voice, (206) 543-2969 FAX [comments to creis]