DeView: Confining Progressive Web Applications by Debloating Web APIs

Chang Seok Oh; Sangho Lee; Chenxiong Qian; Hyungjoon Koo; Wenke Lee

doi:10.1145/3564625.3567987

DeView: Confining Progressive Web Applications by Debloating Web APIs

Chang Seok Oh
, Sangho Lee
, Chenxiong Qian
, Hyungjoon Koo
, Wenke Lee

Department of Computer Science and Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Scopus citations

Abstract

A progressive web application (PWA) becomes an attractive option for building universal applications based on feature-rich web Application Programming Interfaces (APIs). While flexible, such vast APIs inevitably bring a significant increase in an API attack surface, which commonly corresponds to a functionality that is neither needed nor wanted by the application. A promising approach to reduce the API attack surface is software debloating, a technique wherein an unused functionality is programmatically removed from an application. Unfortunately, debloating PWAs is challenging, given the monolithic design and non-deterministic execution of a modern web browser. In this paper, we present DeView, a practical approach that reduces the attack surface of a PWA by blocking unnecessary but accessible web APIs. DeView tackles the challenges of PWA debloating by i) record-and-replay web API profiling that identifies needed web APIs on an app-by-app basis by replaying (recorded) browser interactions and ii) compiler-assisted browser debloating that eliminates the entry functions of corresponding web APIs from the mapping between web API and its entry point in a binary. Our evaluation shows the effectiveness and practicality of DeView. DeView successfully eliminates 91.8% of accessible web APIs while i) maintaining original functionalities and ii) preventing 76.3% of known exploits on average.

Original language	English
Title of host publication	Proceedings - 38th Annual Computer Security Applications Conference, ACSAC 2022
Publisher	Association for Computing Machinery
Pages	881-895
Number of pages	15
ISBN (Electronic)	9781450397599
DOIs	https://doi.org/10.1145/3564625.3567987
State	Published - 5 Dec 2022
Event	38th Annual Computer Security Applications Conference, ACSAC 2022 - Austin, United States Duration: 5 Dec 2022 → 9 Dec 2022

Publication series

Name	ACM International Conference Proceeding Series

Conference

Conference	38th Annual Computer Security Applications Conference, ACSAC 2022
Country/Territory	United States
City	Austin
Period	5/12/22 → 9/12/22

Keywords

Browser
Debloating
PWA
Program Analysis
Progressive Web Application
Record-and-Replay
Web APIs

Access to Document

10.1145/3564625.3567987

Cite this

@inproceedings{25c0a3967e714fc3b75f88fb26473ab0,

title = "DeView: Confining Progressive Web Applications by Debloating Web APIs",

abstract = "A progressive web application (PWA) becomes an attractive option for building universal applications based on feature-rich web Application Programming Interfaces (APIs). While flexible, such vast APIs inevitably bring a significant increase in an API attack surface, which commonly corresponds to a functionality that is neither needed nor wanted by the application. A promising approach to reduce the API attack surface is software debloating, a technique wherein an unused functionality is programmatically removed from an application. Unfortunately, debloating PWAs is challenging, given the monolithic design and non-deterministic execution of a modern web browser. In this paper, we present DeView, a practical approach that reduces the attack surface of a PWA by blocking unnecessary but accessible web APIs. DeView tackles the challenges of PWA debloating by i) record-and-replay web API profiling that identifies needed web APIs on an app-by-app basis by replaying (recorded) browser interactions and ii) compiler-assisted browser debloating that eliminates the entry functions of corresponding web APIs from the mapping between web API and its entry point in a binary. Our evaluation shows the effectiveness and practicality of DeView. DeView successfully eliminates 91.8\% of accessible web APIs while i) maintaining original functionalities and ii) preventing 76.3\% of known exploits on average.",

keywords = "Browser, Debloating, PWA, Program Analysis, Progressive Web Application, Record-and-Replay, Web APIs",

author = "Oh, \{Chang Seok\} and Sangho Lee and Chenxiong Qian and Hyungjoon Koo and Wenke Lee",

note = "Publisher Copyright: {\textcopyright} 2022 Owner/Author.; 38th Annual Computer Security Applications Conference, ACSAC 2022 ; Conference date: 05-12-2022 Through 09-12-2022",

year = "2022",

month = dec,

day = "5",

doi = "10.1145/3564625.3567987",

language = "English",

series = "ACM International Conference Proceeding Series",

publisher = "Association for Computing Machinery",

pages = "881--895",

booktitle = "Proceedings - 38th Annual Computer Security Applications Conference, ACSAC 2022",

}

Oh, CS, Lee, S, Qian, C, Koo, H & Lee, W 2022, DeView: Confining Progressive Web Applications by Debloating Web APIs. in Proceedings - 38th Annual Computer Security Applications Conference, ACSAC 2022. ACM International Conference Proceeding Series, Association for Computing Machinery, pp. 881-895, 38th Annual Computer Security Applications Conference, ACSAC 2022, Austin, United States, 5/12/22. https://doi.org/10.1145/3564625.3567987

DeView: Confining Progressive Web Applications by Debloating Web APIs. / Oh, Chang Seok; Lee, Sangho; Qian, Chenxiong et al.
Proceedings - 38th Annual Computer Security Applications Conference, ACSAC 2022. Association for Computing Machinery, 2022. p. 881-895 (ACM International Conference Proceeding Series).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - DeView

T2 - 38th Annual Computer Security Applications Conference, ACSAC 2022

AU - Oh, Chang Seok

AU - Lee, Sangho

AU - Qian, Chenxiong

AU - Koo, Hyungjoon

AU - Lee, Wenke

PY - 2022/12/5

Y1 - 2022/12/5

N2 - A progressive web application (PWA) becomes an attractive option for building universal applications based on feature-rich web Application Programming Interfaces (APIs). While flexible, such vast APIs inevitably bring a significant increase in an API attack surface, which commonly corresponds to a functionality that is neither needed nor wanted by the application. A promising approach to reduce the API attack surface is software debloating, a technique wherein an unused functionality is programmatically removed from an application. Unfortunately, debloating PWAs is challenging, given the monolithic design and non-deterministic execution of a modern web browser. In this paper, we present DeView, a practical approach that reduces the attack surface of a PWA by blocking unnecessary but accessible web APIs. DeView tackles the challenges of PWA debloating by i) record-and-replay web API profiling that identifies needed web APIs on an app-by-app basis by replaying (recorded) browser interactions and ii) compiler-assisted browser debloating that eliminates the entry functions of corresponding web APIs from the mapping between web API and its entry point in a binary. Our evaluation shows the effectiveness and practicality of DeView. DeView successfully eliminates 91.8% of accessible web APIs while i) maintaining original functionalities and ii) preventing 76.3% of known exploits on average.

AB - A progressive web application (PWA) becomes an attractive option for building universal applications based on feature-rich web Application Programming Interfaces (APIs). While flexible, such vast APIs inevitably bring a significant increase in an API attack surface, which commonly corresponds to a functionality that is neither needed nor wanted by the application. A promising approach to reduce the API attack surface is software debloating, a technique wherein an unused functionality is programmatically removed from an application. Unfortunately, debloating PWAs is challenging, given the monolithic design and non-deterministic execution of a modern web browser. In this paper, we present DeView, a practical approach that reduces the attack surface of a PWA by blocking unnecessary but accessible web APIs. DeView tackles the challenges of PWA debloating by i) record-and-replay web API profiling that identifies needed web APIs on an app-by-app basis by replaying (recorded) browser interactions and ii) compiler-assisted browser debloating that eliminates the entry functions of corresponding web APIs from the mapping between web API and its entry point in a binary. Our evaluation shows the effectiveness and practicality of DeView. DeView successfully eliminates 91.8% of accessible web APIs while i) maintaining original functionalities and ii) preventing 76.3% of known exploits on average.

KW - Browser

KW - Debloating

KW - PWA

KW - Program Analysis

KW - Progressive Web Application

KW - Record-and-Replay

KW - Web APIs

UR - https://www.scopus.com/pages/publications/85144053303

U2 - 10.1145/3564625.3567987

DO - 10.1145/3564625.3567987

M3 - Conference contribution

AN - SCOPUS:85144053303

T3 - ACM International Conference Proceeding Series

SP - 881

EP - 895

BT - Proceedings - 38th Annual Computer Security Applications Conference, ACSAC 2022

PB - Association for Computing Machinery

Y2 - 5 December 2022 through 9 December 2022

ER -

DeView: Confining Progressive Web Applications by Debloating Web APIs

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this