{"id":50115,"date":"2019-11-06T00:00:00","date_gmt":"2019-11-06T00:00:00","guid":{"rendered":"https:\/\/www.cpr.cuhk.edu.hk\/press\/cuhk-faculty-of-engineering-develops-browser-based-analysis-framework-observerdetecting-malicious-click-interception-and-mitigating-web-security-threat\/"},"modified":"2019-11-06T00:00:00","modified_gmt":"2019-11-06T00:00:00","slug":"cuhk-faculty-of-engineering-develops-browser-based-analysis-framework-observerdetecting-malicious-click-interception-and-mitigating-web-security-threat","status":"publish","type":"press","link":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/press\/cuhk-faculty-of-engineering-develops-browser-based-analysis-framework-observerdetecting-malicious-click-interception-and-mitigating-web-security-threat\/","title":{"rendered":"\u4e2d\u5927\u5de5\u7a0b\u5b78\u9662\u7814\u767c\u700f\u89bd\u5668\u5206\u6790\u7cfb\u7d71Observer\u8ffd\u8e64\u60e1\u610f\u9ede\u64ca\u6514\u622a\u3000\u6e1b\u8f15\u7db2\u7d61\u5b89\u5168\u5a01\u8105"},"content":{"rendered":"","protected":false},"featured_media":0,"template":"","tags":[],"class_list":["post-50115","press","type-press","status-publish","hentry"],"acf":{"title_alt":"","sub_title_alt":"","press_date":"20191106","keep":false,"details":"<p>\u4e0d\u826f\u7b2c\u4e09\u65b9\u5ee3\u544a\u5546\u6216\u99ed\u5ba2\u5728\u7db2\u9801\u4e2d\u52a0\u5165\u60e1\u610fJavaScript\u4ee3\u78bc\u4f86\u6514\u622a\u700f\u89bd\u8005\u9ede\u64ca\uff0c\u6b3a\u9a19\u4ed6\u5011\u8a2a\u554f\u4e0d\u53d7\u4fe1\u4efb\u7684\u7db2\u9801\uff0c\u4ee4\u7db2\u7d61\u7528\u6236\u5b89\u5168\u53d7\u5230\u5a01\u8105\u3002\u70ba\u4e86\u5075\u6e2c\u6b64\u9ede\u64ca\u6514\u622a\u884c\u70ba\uff0c\u9999\u6e2f\u4e2d\u6587\u5927\u5b78\uff08\u4e2d\u5927\uff09\u5de5\u7a0b\u5b78\u9662\u8a08\u7b97\u6a5f\u79d1\u5b78\u8207\u5de5\u7a0b\u5b78\u7cfb\u5b5f\u744b\u6559\u6388\u53ca\u5176\u5718\u968a\uff0c\u7814\u767c\u51fa\u700f\u89bd\u5668\u5206\u6790\u7cfb\u7d71Observer\uff08\u89c0\u5bdf\u8005\uff09\uff0c\u53ef\u6aa2\u6e2c\u4e09\u7a2e\u7528\u65bc\u6514\u622a\u7db2\u7d61\u7528\u6236\u9ede\u64ca\u7684\u4e0d\u540c\u6280\u8853\u3002\u7814\u7a76\u6210\u679c\u5df2\u65bc\u570b\u969b\u9802\u5c16\u7684\u8a08\u7b97\u6a5f\u5b89\u5168\u5b78\u8853\u6703\u8b70USENIX Security Symposium 2019\uff08USENIX Security &rsquo;19\uff09\u767c\u8868\u3002\u5718\u968a\u5c07\u516c\u958bObserver\u7cfb\u7d71\u6e90\u4ee3\u78bc\uff0c\u5354\u52a9\u7db2\u7d61\u7528\u6236\u6aa2\u6e2c\u60e1\u610f\u7684\u9ede\u64ca\u6514\u622a\uff0c\u4e26\u5c31\u6b64\u60e1\u610f\u884c\u70ba\u767c\u51fa\u8b66\u544a\uff0c\u4fdd\u969c\u4ed6\u5011\u514d\u906d\u60e1\u610f\u7db2\u7ad9\u7684\u5f71\u97ff\u3002<\/p><p>\u9ede\u64ca\u662f\u7528\u6236\u8207\u842c\u7dad\u7db2\uff08World Wide Web, WWW\uff09\u4e0a\u5167\u5bb9\u9032\u884c\u4e92\u52d5\u7684\u4e3b\u8981\u65b9\u5f0f\u3002\u56e0\u6b64\uff0c\u653b\u64ca\u8005\u6514\u622a\u771f\u5be6\u7684\u7528\u6236\u9ede\u64ca\uff0c\u88fd\u9020\u5ee3\u544a\u9ede\u64ca\u6d41\u91cf\u4ee5\u9032\u884c\u5ee3\u544a\u9ede\u64ca\u6b3a\u8a50\uff0c\u6216\u4ee5\u7528\u6236\u7684\u8eab\u5206\u5411\u5176\u4ed6\u7db2\u7ad9\u767c\u9001\u60e1\u610f\u6307\u4ee4\uff0c\u4f8b\u5982\u8feb\u4f7f\u7528\u6236\u4e0b\u8f09\u75c5\u6bd2\u7a0b\u5f0f\u3002\u4ee5\u5f80\u7684\u7814\u7a76\u4e3b\u8981\u91dd\u5c0d\u5176\u4e2d\u4e00\u7a2e\u5728\u8de8\u57df\u8a2d\u5b9a\u4e2d\u901a\u904eiframe\u9032\u884c\u7684\u9ede\u64ca\u6514\u622a\uff0c\u7a31\u70ba\u9ede\u64ca\u52ab\u6301\uff08clickjacking\uff09\uff0c\u901a\u5e38\u662f\u7531\u60e1\u610f\u7684\u7b2c\u4e00\u65b9\u7db2\u7ad9\u767c\u8d77\u3002\u4f46\u9019\u985e\u7814\u7a76\u672a\u80fd\u61c9\u5c0d\u53ef\u7531\u7b2c\u4e09\u65b9JavaScript\u4ee3\u78bc\u767c\u52d5\u7684\u5404\u7a2e\u9ede\u64ca\u6514\u622a\u3002<\/p><p>\u91dd\u5c0d\u6b64\u672a\u6709\u9032\u884c\u4efb\u4f55\u7814\u7a76\u7684\u9818\u57df\uff0c\u4e2d\u5927\u5de5\u7a0b\u5b78\u9662\u8a08\u7b97\u6a5f\u79d1\u5b78\u8207\u5de5\u7a0b\u5b78\u7cfb\u5b5f\u744b\u6559\u6388\u53ca\u5176\u535a\u58eb\u7814\u7a76\u751f\u5f35\u660e\u96ea\u958b\u767c\u4e86\u5efa\u57fa\u65bcGoogle\u958b\u6e90\u700f\u89bd\u5668\u7684\u5206\u6790\u7cfb\u7d71Observer\uff0c\u6709\u7cfb\u7d71\u5730\u8a18\u9304\u53ca\u5206\u6790\u842c\u7dad\u7db2\u4e0a\u5404\u985e\u9ede\u64ca\u6514\u622a\u884c\u70ba\u3002\u4ed6\u5011\u5229\u7528Observer\u5206\u6790\u4e86Alexa\uff08\u5168\u7403\u7db2\u7ad9\u6392\u540d\u8a08\u7b97\u7cfb\u7d71\uff09\u999625\u842c\u500b\u7db2\u7ad9\uff0c\u5728\u5176\u4e2d613\u500b\u53d7\u6b61\u8fce\u7db2\u7ad9\uff08\u6bcf\u65e5\u7e3d\u700f\u89bd\u91cf\u7d044,300\u842c\u4eba\u6b21\uff09\u4e0a\u767c\u73fe\u6709437\u500b\u7b2c\u4e09\u65b9\u4ee3\u78bc\u5728\u6514\u622a\u7528\u6236\u9ede\u64ca\u3002\u9019\u4e9b\u4ee3\u78bc\u901a\u904e\u6514\u622a\u7528\u6236\u9ede\u64ca\u53ef\u8a98\u9a19\u7528\u6236\u8a2a\u554f3,251\u500b\u88ab\u7b2c\u4e09\u65b9\u64cd\u63a7\u7684\u4e0d\u53d7\u4fe1\u4efb\u7684\u7db2\u5740\uff0c\u5176\u4e2d\u903e36%\u8207\u5728\u7dda\u5ee3\u544a\u6709\u95dc\uff0c\u53e6\u6709\u90e8\u5206\u9ede\u64ca\u6514\u622a\u7db2\u5740\u6703\u5c07\u7528\u6236\u5f15\u5411\u60e1\u610f\u5167\u5bb9\u5982\u8a50\u9a19\u8edf\u4ef6\uff0c\u8aaa\u660e\u9ede\u64ca\u6514\u622a\u5df2\u6210\u70ba\u7db2\u7d61\u7528\u6236\u7684\u65b0\u8208\u5a01\u8105\u3002<\/p><p>\u8a72\u7814\u7a76\u78ba\u8a8d\u4e86\u9ede\u64ca\u6514\u622a\u6280\u8853\u7684\u4e09\u5927\u985e\u578b\uff1a(1) \u66f4\u6539\u8d85\u9023\u7d50\u7684\u76ee\u6a19\u7db2\u5740\uff0c\u7576\u7528\u6236\u9ede\u64ca\u6642\u5c07\u5176\u5f15\u5c0e\u81f3\u60e1\u610f\u7db2\u7ad9\uff1b(2) \u901a\u904e\u65b0\u589e\u76e3\u807d\u4e8b\u4ef6\uff08Event Listener\uff09\u4f86\u6b3a\u9a19\u7528\u6236\u9ede\u64ca\u3002(3) \u8996\u89ba\u77c7\u9a19\uff0c\u4f8b\u5982\u6a21\u4eff\u7b2c\u4e00\u65b9\u7db2\u7ad9\u5167\u5bb9\u88fd\u4f5c\u7db2\u9801\uff0c\u6b3a\u9a19\u7528\u6236\u9ede\u64ca\u7531\u7b2c\u4e09\u65b9\u675c\u64b0\u7684\u5143\u7d20\uff0c\u6216\u4ee5\u900f\u660e\u4ecb\u9762\u8986\u84cb\u6574\u500b\u7248\u9762\uff0c\u6514\u622a\u7528\u6236\u5c0d\u7b2c\u4e00\u65b9\u5167\u5bb9\u7684\u6240\u6709\u9ede\u64ca\uff0c\u5c07\u7528\u6236\u5e36\u5230\u7531\u653b\u64ca\u8005\u63a7\u5236\u7684\u7db2\u9801\u3002<\/p><p>\u773e\u6240\u5468\u77e5\uff0c\u7531\u7b2c\u4e09\u65b9JavaScript\u4ee3\u78bc\u555f\u52d5\u7684\u7db2\u9801\u884c\u70ba\u662f\u5f88\u96e3\u7528\u4f5c\u8a18\u9304\u548c\u5206\u6790\u7684\u3002Observer\u7cfb\u7d71\u901a\u904e\u64f4\u5c55\u700f\u89bd\u5668\u4ee5\u6536\u96c6\u904b\u884c\u6642\u7684\u884c\u70ba\uff0c\u91dd\u5c0d\u9ede\u64ca\u76f8\u95dc\u7684\u884c\u70ba\u4f5c\u5fb9\u5e95\u5206\u6790\uff0c\u4ee5\u6b64\u4f86\u6aa2\u6e2c\u7b2c\u4e09\u65b9\u7684\u9ede\u64ca\u6514\u622a\u884c\u70ba\u3002\u8a72\u7cfb\u7d71\u53ef\u4fdd\u969c\u7528\u6236\u514d\u53d7\u9019\u4e9b\u60e1\u610f\u653b\u64ca\u5a01\u8105\uff0c\u5177\u6709\u91cd\u5927\u7684\u610f\u7fa9\u3002\u5b5f\u6559\u6388\u63a8\u65b7\uff0c\u9ede\u64ca\u6514\u622a\u6216\u6e90\u65bc\u7b2c\u4e09\u65b9\u7db2\u9801\u958b\u767c\u4eba\u54e1\u6feb\u7528\u6b0a\u9650\uff0c\u85c9\u6514\u622a\u7528\u6236\u9ede\u64ca\u4f86\u9032\u884c\u5ee3\u544a\u9ede\u64ca\u7387\u6b3a\u8a50\u4ee5\u5716\u5229\u3002\u4ed6\u8aaa\uff1a\u300c\u6211\u5011\u5c07\u516c\u958b\u6b64\u7cfb\u7d71\u7684\u6e90\u4ee3\u78bc\uff0c\u8b93\u700f\u89bd\u5668\u958b\u767c\u8005\u53ef\u4ee5\u4f9d\u6b64\u8a2d\u8a08\u9632\u79a6\u6a5f\u5236\u5c0d\u6297\u9ede\u64ca\u6514\u622a\uff0c\u4f8b\u5982\uff0c\u4ed6\u5011\u53ef\u5411\u7528\u6236\u767c\u51fa\u5b89\u5168\u8b66\u544a\uff0c\u963b\u6b62\u4ed6\u5011\u8a2a\u554f\u6709\u6f5b\u5728\u60e1\u610f\u7684\u7db2\u9801\uff0c\u9019\u53ef\u5e6b\u52a9\u5efa\u7acb\u66f4\u5b89\u5168\u7684\u7db2\u7d61\u751f\u614b\u74b0\u5883\u3002\u300d<\/p>","show_as_achievement":false,"achievement_category":[],"show_as_clarification":false,"show_as_announcement":false,"photos":null,"attachments":null,"video_source":null,"video_file":null,"add_play_button":false,"video_caption":"","show_migration":false,"original_id":"3158","photos_original":[{"photo":"5dc28abaa015a.jpg","caption":"\u5b5f\u744b\u6559\u6388"}],"attachments_original":null},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/wp-json\/wp\/v2\/press\/50115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/wp-json\/wp\/v2\/press"}],"about":[{"href":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/wp-json\/wp\/v2\/types\/press"}],"version-history":[{"count":0,"href":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/wp-json\/wp\/v2\/press\/50115\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/wp-json\/wp\/v2\/media?parent=50115"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cpr.cuhk.edu.hk\/tc\/wp-json\/wp\/v2\/tags?post=50115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}