WebMTD

Abstract

Existing mitigation techniques for Web code injection attacks have not been widely adopted, primarily due to incurring impractical overheads on the developer, Web applications, or Web browsers. They either substantially increase Web server/client execution time, enforce restrictive coding practices on developers, fail to support legacy Web applications, demand browser code modification, or fail to provide browser backward compatibility. Moving Target Defense (MTD) is a novel proactive class of techniques that aim to defeat attacks by imposing uncertainty in attack reconnaissance and planning. This uncertainty is achieved by frequent and random mutation (randomization) of system configuration in a manner that is not traceable (predictable) by attackers. In this paper, we present WebMTD, a proactive moving target defense mechanism that thwarts a broad class of code injection attacks on Web applications, including cross-site scripting (XSS), HTML code injection, and server-side code injection attacks, in a manner that is transparent to developers, Web applications and browsers. Relying on built-in features of modern Web browsers, WebMTD randomizes certain attributes of Web elements to differentiate the application code from the injected code and disallow its execution; this is done without requiring Web developer involvement and browser code modification. Through rigorous evaluation, we show that WebMTD has very low performance overhead. Also, we argue that our technique outperforms all competing approaches due to its broad effectiveness, transparency, and low overhead. We claim that these qualities make WebMTD an ideal technique for defeating Web code injection attacks on real-world production Web applications.