Using Context to Verify User Intentions

A malware on the user client 1 may generate service requests to a remote service without user’s awareness. One possible defense is CAPTCHA. However, CAPTCHA falls prey to a more powerful attacker with operating system(OS)-level privilege. An OS-level attacker may tamper with program memory stealthily so that the service request generated from the memory is not what user intended. We call this type of attack OS-level user impersonation attack (OS-UImp). The state-of-the-art defenses [5, 6, 10, 13, 17] for OS-UImp try to revealed user intentions to the service. But they assume the user has a clear intention, perceives the UI correctly and performs the extra work as imposed by the individual solution correctly. We challenge this assumption. Prior work on UI attacks [12,21,23,24] has shown the feasibility to affect user perception through UI modification. We identify a new class of UI attack called Context Forgery (CF), where an OS-level attacker modifies the UI to trick the user into carry out unintended actions which result in unintended service requests — the same consequence as OS-UImp. All of existing defense for OS-UImp fall prey to CF. In summary, the limitations of the state-of-the-art defenses of OS-UImp are: 1 extra user effort is required and 2) vulnerable to Context Forgery attacks. We believe it is possible to build a solution to OS-UImp while avoiding the two limitations. We hypothesize that it is possible to build a solution that "sees what the user sees". Specifically, to prevent context forgery attacks on a web page, a solution is to ensure that what user sees matches the expected appearance of the web page designer, thus no tampering is possible. And to prevent user impersonation attack, by "seeing" how the user interacts with the page, we can infer her intention. By "seeing what the user sees", no extra effort is required on the user side. We illustrate our solution in the rest of this section. Project Statement. We believe it is possible to build a solution to OS-UImp while the two limitations. We hypothesize that it is possible to build a solution that "sees what the user sees". Specifically, to prevent context forgery attacks on a web page, a solution is to ensure that what user sees matches the expected appearance of the web page designer, thus no tampering is possible. And to prevent user impersonation attack, by "seeing" how the user interacts with the page, we can infer her intention. By "seeing what the user sees", no extra effort is required on the user side. We illustrate our solution in the rest of this section. We propose Attested Intention(AINT), a framework that defeats both OS-UImp and CF. AINT extracts the client-side display and validates it against specifications from services. Since AINT cannot rely on the OS, it proposes a design guideline, called Tabularization, for remote services to design better machine-checkable web pages. Tabularization requires the service to place UI elements into a tabular structure so that each cell can be individually validated. This method divides the difficult problem of validating the entire page into many simpler problems of validating cells. When a tabularized is rendered on the client side, AINT validates it using a combination of image hash and optical character recognition (OCR). Image hashes