JavaScript security: the elephant running in your browser
John Graham-Cumming
Visit any major website, such as a bank or a retailer, and your web browser will run small pieces of JavaScript for web
analytics, ad serving, automatic offer targeting or Amazon.com-style recommendations. These so-called tags weren't written
by the owner of the website but were provided by a third party. Yet JavaScript's security model, or lack of it, means that
any piece of JavaScript in a page can interact with any other piece and with the page itself. So, how does a major bank
or retailer know that this code isn't malicious? And where did the code come from? In most cases the website owner has
little idea what the codes does, and it typically gets delivered by unsecured email.
This paper and talk look at the risks, both technical and procedural, of the current state of JavaScript page tagging
with specific examples from actual websites. It then examines the projects such as CAJA, adSAFE and jsHub that attempt
to eliminate this sorry, and potentially disastrous, state of affairs.
