Who changed my browser settings? Silently modifying the Secure Preferences of Chrome

Visa enkel post
dc.contributor.authorAxelsson, Gustav
dc.contributor.authorSundling, Joakim
dc.contributor.departmentChalmers tekniska högskola / Institutionen för data och informationstekniksv
dc.contributor.examinerMitrokotsa, Katerina
dc.contributor.supervisorPablo, Picazo-Sanchez
dc.date.accessioned2019-07-19T08:18:56Z
dc.date.available2019-07-19T08:18:56Z
dc.date.issued2019sv
dc.date.submitted2019
dc.description.abstractGoogle Chrome is as of today the most used web browser in the world. With millions of daily users the security of the browser is of high importance. When using Google Chrome each user obtains a couple of configuration files for storing information such as bookmarks, browser history, homepage and a multitude of other settings. One of these files is the Secure Preferences file in which some of the browsers most sensitive settings are stored. In order to protect these settings Chrome has added custom Hash-based Message Authentication Codes (HMACs) that are used to ensure that no settings are silently modified by third parties. This thesis describes how this security can be circumvented and implements a versatile script, for Windows, that is able to alter all the information stored in Secure Preferences without alerting the browser. This thesis also describes the steps taken in order to reproduce the hashing mechanism of Chrome as well as how different preferences can be exploited. An extension is developed which makes it possible to run the script from the Chrome browser. The script is then evaluated together with the extension by both checking the correctness of the HMAC calculation and how well it is able to perform a variety of exploits. This thesis proves that it is indeed possible to break the security of the Secure Preference file. By reproducing and replacing the HMACs which gives the user of the script the possibility to alter frequently used functions in Chrome such as homepage, new tabs, extensions and default search engine.sv
dc.identifier.coursecodeDATX05sv
dc.identifier.urihttps://hdl.handle.net/20.500.12380/300055
dc.language.isoengsv
dc.setspec.uppsokTechnology
dc.subjectComputersv
dc.subjectsciencesv
dc.subjectcomputer sciencesv
dc.subjectengineeringsv
dc.subjectprojectsv
dc.subjectthesissv
dc.subjectGoogle Chromesv
dc.subjectpreferencessv
dc.subjectsecure preferencessv
dc.titleWho changed my browser settings? Silently modifying the Secure Preferences of Chromesv
dc.type.degreeExamensarbete för masterexamensv
dc.type.uppsokH
Ladda ner
Original bundle
Visar 1 - 1 av 1
Bild (thumbnail)
Namn:
CSE 19-12 Axelsson_ Sundling.pdf
Storlek:
976.66 KB
Format:
Adobe Portable Document Format
Beskrivning:
Who changed my browser settings? Silently modifying the Secure Preferences of Chrome
Ladda ner
License bundle
Visar 1 - 1 av 1
Bild (thumbnail)
Namn:
license.txt
Storlek:
1.14 KB
Format:
Item-specific license agreed upon to submission
Beskrivning:
Ladda ner
Samling
Examensarbeten för masterexamen