Unfortunately, we quickly came to the conclusion that the application of hardware security to web applications is a research problem, and a little way off practical implementation. There are several challenges in making productive use of hardware mechanisms – processor security extensions, secure elements, TPMs and so on – which need more thought from the industry as a whole.

I’m therefore very pleased to announce that The Workshop on Web Applications and Secure Hardware (WASH’13) will be happening this Thursday (20th June) at Imperial College London, in conjunction with the TRUST 2013 conference. We have an exciting programme, featuring talks from The University of Oxford, TU Graz, Gemalto, Inventive Designers, Royal Holloway, the FIDO Alliance and Ericsson. For more information see the online pre-proceedings. If you would like to attend (there’s no registration fee) there are a few spaces available.

We hope that the result of this event will be some practical ideas for applications of security hardware to enhance the security and privacy of users of web applications, in terms of authentication, malware protection and phishing.

This event is sponsored by Gemalto. All papers presented at the workshop will be made available online, for free.

After receiving some great comments – thanks to all who got in touch with me – I decided to write a follow-up article expanding further on this question.

Many people pointed out (as I did in the original article) that nodejs and the NPM repository were just one example of the problem. The same could be argued of Ruby Gems, PHP, or any package management and web framework system. Indeed, one could ask the same question of the Debian package management system, which has been going for much longer and has many more packages available. This is all absolutely true. It seems that malware is extraordinarily rare on most package management systems. Even the Google Play Market for Android – much maligned for containing malware – actually has a good track record* considering the number of applications available. Compared to downloading files from arbitrary websites and shareware, app stores appear to be significantly more reliable. Why is that? What makes a package management systems such a good security mechanism, despite the apparent lack of oversight or significant security controls?

App stores and package repositories do offer some accountability, as well as revocation and, potentially, mediation. Developers have to ‘sign up’ in one way or another to an app store or package repository, and can then be held accountable when their submission is found to be harmful. This is only of limited value in most repositories, as new user accounts can easily be created, but makes a reputation for good software something worth protecting. Furthermore, if the repository charges money to create an account or upload a new module, then this money is lost when the terms of service are violated. Revocation is probably more important: when an application or module is identified to be malicious, it can be removed before doing further damage to other people. This provides no protection for early adopters, but the more cautious certainly benefit. Of course, the benefit is lessened if automatic updates are allowed, as malware can be disguised as legitimate software until it reaches maximum market penetration, and then can be modified to exploit the end user. Mediation is often cited as an advantage of a package repository or app store, and the reason why Apple have avoided significant security incidents. Unfortunately, unless you have Apple-like resources, this is unlikely to be cost effective. One of the few exceptions to this rule is third-party mobile app stores. There is something of a malware issue on Android app stores outside the US and western Europe (essentially anywhere that Google Play doesn’t dominate).

Where does nodejs fit in? When I wrote the last article, there was no evidence of any malware, but also no evidence of any accountability, mediation or revocation mechanisms. The NPM repository offers no way to report bad modules and accountability appears minimal. Nodejs certainly isn’t special, but should malware writers take the time to focus on it, it could be especially bad.

Perhaps it is more interesting to ask whether it is worth writing malware for nodejs? As I mentioned in my first post, the potential targets are certainly rich enough. Almost all server-side web apps will have some privileged access to data or services. While good system design can mitigate some of the threats — I received several comments suggesting that TLS connections should not be terminated by the nodejs app, but should use a reverse proxy such as Nginx instead, to protect private keys — it can’t mitigate them all. Furthermore, the reality is likely to be far from the best practice: I suspect many people do run nodejs applications with super-user privileges, and without trying to protect against these kind of attacks.

If malware is a possibility (and is still potentially lucrative) then why does it appear to be so scarce? Having thought about this problem for a while, I can only assume that it is because such malware does not offer a high reward/effort ratio. There is too much low-hanging fruit elsewhere (phishing end users, for example) to make this particular avenue of attack worthwhile. For one thing, it is probably too hard to automate using server-side malware after it has been deployed. There are thousands of ways in which each endpoint might be configured, and no obvious single set of malicious actions that might be performed. As a targeted attack it would be effective (an attacker could spend time exploiting the specific machine it was installed on) but this would rely upon the target making use of this module, which is relatively unlikely. This kind of attack can only work if planned a long way in advance, and if it can be effectively deployed and run on multiple targets at the same time. Indeed, for this kind of malware to be successful, the author would have to develop a popular nodejs module in the first place, which is a significant amount of work. If the exploit is then enabled by an update, it would then be reliant on developers frequently updating their modules. On balance, therefore, it seems that nodejs malware simply isn’t worth the effort.

A more worrying possibility was exposed by Adam Baldwin recently. He discovered that a CSRF flaw on npmjs potentially allowed anyone to update any package. This dramatically shifts the reward/effort ratio. If an attacker simply has to repackage a legitimate module with a few additional malicious components, and then wait for developers to run updates, the impact could be enormous. For example, the ‘underscore’ module has been downloaded nearly 10,000 times in the last day, and has over 1000 other modules depending on it. There will be hundreds of developers who may not even realize that they are using this module. If it was updated to include, say, virus.js with a more malicious payload, thousands of production boxes might be at risk.

However, the main threat from nodejs packages is currently badly written software rather than malicious software. Of the 32 thousand nodejs modules on NPM, it’s not crazy to suggest that several hundred will have exploitable vulnerabilities. Simple attacks, such as malicious content injection, will be present in many modules. Native modules may suffer from all the classic exploits found in any other piece of software. To combat this, the Node Security project aims to audit and inspect every nodejs module and provide “advisories, issues and pull requests so modules get fixed”. This is a laudable goal, although the sheer amount of effort required is daunting. Inspecting this number of modules seems impractical and it is inevitable that only a subset of security issues will be identified. There is a good opportunity for program analysis: if modules can be assessed in an automated way to identify common flaws then the general level of security can be raised without too high a cost. Indeed, the idea of automatic exploit generation is something that The University of Oxford has an interest in, and was recently discussed at the Crest Open Workshop on Malware (PDF presentation by Daniel Kroening). There are many questions as to how such automated vulnerability analysis should be performed in a responsible manner, but the technology exists to make a big difference to a very large number of systems.

One potential system-level mitigation for vulnerable nodejs modules is the use of least-privilege permissions like those found in mobile applications. If developers could intentionally limit themselves to only certain built-in nodejs modules (e.g., just “URL” and “HTTP” modules) then this would greatly reduce the impact of a vulnerability being exploited. Of course, it would not help those modules that have “file” or “process” permissions, but it would aid the auditing effort as only privileged modules would need extensive review. I expect that the same security controls we see employed to protect user-focused applications will slowly begin to find their way into developer-focused tools.

Finally, I’ll end this somewhat rambling blog post by proposing that this is a very promising area of research. With NPM we have a huge, open source repository of source code that has not, in general, been subject to much security analysis. This is ripe for studies on how good developers are at implementing secure software, how effective particular mitigations might be, and identification of the most common mistakes.

* Caveat: we don’t know how much mobile malware exists, but evidence suggests it does not affect many US users of Android or iOS.

For guidance and demonstration during the workshops, members of the webinos developer team produced the chat app tutorial. Now we published this tutorial with code examples and project template on our developer portal. In particular, we look forward to receiving your feedback!

For further questions, please contact our developer team:

Alexander Futasz, alexander.futasz@fokus.fraunhofer.de

Shanshan Yang, shanshan.yang@fokus.fraunhofer.de

On September 9th, we will — in conjunction with our colleagues at Oxford Brookes university — be organising a workshop on the human implications of building mobile apps at the British HCI 2013 conference in London. The Human Aspects in Mobile Applications Engineering workshop brings together researchers from industry and academia in order to explore the challenges and opportunities presented by incorporating human aspects in mobile apps engineering.

The topics addressed by HAMAE2013 include, but are not limited to:

• Empirical studies informing mobile app design
• Behavioural research on the use of mobile apps
• Mobile applications usability evaluation: studies and techniques
• Social and cultural aspects in mobile app engineering
• Studies of mobile app stores
• Development models in mobile app engineering
• Reports on development cycles of mobile apps
• Non-functional aspects (i.e. privacy and security) in mobile app engineering
• Tools and applications to support mobile app engineering

We invite paper (4 pages), poster (2 pages), and demonstration (2 pages) submissions.
Late breaking results, new ideas, and on-going doctoral research or research projects are especially encouraged. All submissions must be made electronically via EasyChair. Accepted position and poster/demonstration papers will be published in the workshop proceedings, and made available via the BCS eWiC repository.

Important dates:
* Submission deadline: June 14th, 2013
* Author notification: July 25th, 2013
* Publication ready version: August 9th, 2013
For more information, please visit the workshop website.

The video above shows the application running on an Android Phone and an Arduino Board to which light, temperature and humidity sensors as well as light switch actuator are connected. Both, the Android Phone and Arduino Board run PZPs which are connected the the same PZH. Due to resource limitation on the Arduino Board, it implements only basic functionalities of a PZP mainly register services for all sensors and actuators as specified in the generic webinos Sensor and Actuator APIs. The application running on the smartphone is implemented using purely web technologies and frameworks such as jQuery Mobile and webinos Discovery API to discover all sensors and actuators registered in the personal zone. The user can select a sensor from the list to monitor it or an  actuator to control it. For this, the application uses the Service.bind() function which is also provided by the Discovery API to connect to a specific sensor or actuator service exposed by Arduino Board.

Screenshots:

• Monitor temperature in the kitchen

• List of available sensors

• Light in the kitchen is On

• Light in the kitchen is Off

webinos participated in the Future Internet Assembly 2013 event, which was held in association with the Irish presidency of the Council of the EU in Dublin, 8-10th May 2013. Future Internet Assembly is a research community driven initiative [...] supported by more than 150 research projects that have recognised the need to strengthen European activities on the Future Internet (FI) to maintain European competitiveness in the global marketplace. [...]. FIA events have been hosted regularly by the European Commission since 2008 (http://www.future-internet.eu) aiming to redesign a significant part of the Internet, taking a broad multidisciplinary approach, to meet European societal, business and technology ambitions.

The theme for FIA-Dublin was “Future Internet accelerates Innovation”, and the event focused on how European Future Internet research and innovation will support EU’s competitiveness and enable a new wave of technologies at the eve of Horizon 2020 (ec.europa.eu/research/horizon2020/).

webinos had a strong presence at the event including a presentation of webinos by Javier Caminero, Program Manager at Telefonica R&D and webinos partner, a booth at the Exhibition area with several live webinos technology demos and a Poster. Exhibition visitors had the opportunity to see webinos in action through demos like the webinos-enabled Katwarn system, webinosTV, the car automation demo (http://www.youtube.com/watch?v=I9sH9pH_eK0) and some of the winning apps from the 2nd webinos App Challenge (http://www.youtube.com/watch?v=WYxmvIhiDNE).

webinos delegation comprised Javier Caminero of Telefonica, Christian Fuhrhop of Fraunhofer FOKUS, Heiko Desruelle of iMinds, Nick Allot of NquiringMinds, Christos Botsikas of NTUA and George Voulgaris of VisionMobile.

The presentation that took place on the 28th of April focused on the webinos architecture and the ease by which web applications can be augmented and even be made possible with minimum effort using webinos, showcasing some of the best demos created for the platform, as well as the most successful entries in the latest App Challenge.

The webinos booth at the exhibition area was the perfect opportunity for the young developers to have a hands-on experience with the platform in order to be inspired to start developing webinos-enabled apps and to brainstorm together with members of the webinos team for potential entries in the next App Challenge.

webinos @ ecescon 6 Location: Novotel Athenes, Greece

Dates: 26,27,28 April 2013

Presenters: Christos Botsikas, Christos Ntanos

Learn how webinos as an open source platform connects your devices securely and allows Web-technologies based applications to run and use services and resources across different domains such as mobile, desktop, home media, in-car infotainment and Internet of Things (IoT).

Bring your development laptop and optionally an android device and get involved in the practical setup and coding session. You have already an idea for a multi-screen application? Excellent! Develop your first webinos application with immediate support and share your feelings with us. Get a glimpse of the Webinos repository at github.

Requirements: Laptop (Linux, Mac, Windows) with disk space to load and install additional software, basic Web development skills (HTML, CSS and JavaScript).

Trainer: Martin Lasak studied computer engineering at the Technische Universität Berlin. He graduated with the completion of his thesis on Privacy and Integrity Preservation in Client-Side Web Mashups in the field of Open Communication Systems. Employed as research associate at the Competence Center Future Applications and Media (FAME) of Fraunhofer FOKUS, Martin mainly focuses his research activities on multi-device architectures and Web security. He has been involved in national and international industry and research projects covering cross-platform computing and distributed applications.

Venue: Many thanks to the Estonian Information Technology College for the awesome venue. For those who don’t know them yet – IT College is the leading IT institution of applied higher education in Estonia. What makes the IT College special is its academic staff that are all professionals in the field – a third of all of the lecturers come from IT firms and companies or state IT departments. And obviously the fact that Yep is formed by graduates of IT College.

Register here, only 30 spots available.

Next to re:publica and Heureka the brandnew format „Codemotion Berlin“ was another main-hightlight of the Berlin Web Week Festival 2013. webinos was proud to organize a code workshop in conjunction with Fraunhofer FOKUS. In a hands-on, practical workshop participants learned how interoperability with other device types and platforms can be fostered and how multiscreen application development can be eased.

Codemotion was an innovative tech event engaging developers of all languages and technologies in presentations and conversations about: Mobile, Web, Makers, Startup Ideas, Trends, Sustainability, Game Dev and Creative Coding. Codemotion was a 3 day event with one day dedicated to workshops and two days of Conference.

webinos will organize a developer workshop at the codemotion event (www.codemotionberlin.com) in Berlin, 09-11 May 2013.

Codemotion is an innovative tech event engaging developers of all languages and technologies in presentations & conversations about: mobile, web, makers, startup ideas, sustainability, game development and creative coding. Codemotion brings together the largest number of attendees, companies and communities. In 2013, Codemotion will be arriving in Berlin. The agenda is a full immersion of technical talks created with the help of all developer communities, including a public call of papers.

webinos has the pleasure to invite particpants for a hands-on practical workshop in the Fraunhofer webinos Lab with trainers from the webinos developer team. The workshop will be held at Codemotion Berlin on Saturday 11 May 2013, 2pm-4pm. See below for further information regarding registration, location, time and requirements.

Trainers: Alexander Futasz, Shanshan Yang, Robert Kleinfeld

Agenda

This workshop offers an insight in the development of multiscreen applications with the webinos project. webinos is an open source platform that connects user’s devices securely and allows Web-based applications to run and use services and resources across different domains such as mobile, desktop, home media, in-car infotainment and Internet of Things (IoT). In a hands-on, practical workshop participants will learn how interoperability with other device types and platforms can be fostered and how multiscreen application development can be eased.

1. Introduction

The first part of the workshop will consists of a brief introduction to the webinos project, as well as the demonstration of multiscreen applications that are developed with webinos APIs.

2. Installation

The next part involves installing and running the webinos open source platform.

3. webinos App Development

The main part of the workshop deals with developing webinos applications based on webinos APIs such as Widget API, Discovery API, Messaging API and Device Orientation API. Application development can sound like a daunting task. Fortunately, creating a webinos application is surprisingly simple. Therefore we will start with a simple “hello world” application. On this basis we will learn how much more sophisticated webinos applications can be through use of webinos APIs, as defined in the API specifications.

4. Multiscreen Applications

As a highlight we will create a simple multiscreen application live during the workshop, demonstrating that developing multiscreen applications does not require a complete rethinking of traditional development workflows. Afterwards, we will briefly look at how developers can benefit from the webinos open source platform targeted on multiscreen applications.

Trainers

Alexander Futász

Alexander Futász studied Computer Science at the Berlin Institute of Technology, where he recently finished his studies and is now waiting for his degree. He is senior research engineer and project manager at the Competence Center Future Applications and Media FAME at Fraunhofer Institute for Open Communication Systems FOKUS in Berlin. Alexander Futász has been and is involved in multiple international and national projects (webinos, MWR, BIONETS) within the area of: Social Media Computing, Cloud-based Services and Next Generation Web Platforms for Multiscreen Applications.

Shanshan Yang

Shanshan Yang studied Computer Science at the University of Freiburg. She received her master degree in Computer Science in 2010. She is senior research engineer at the Competence Center Future Applications and Media FAME at Fraunhofer Institute for Open Communication Systems FOKUS in Berlin. She integrated different approaches from different domains like Knowledge management, Integrated circuit design and Software testing. Shanshan Yang involved in multiple international and national projects (webinos, MyRehab).  Her ongoing research activities focus on Cloud-based Services and Next Generation Web Platforms for Multiscreen Applications.

Robert Kleinfeld

Robert Kleinfeld studied Computer Science at the Leipzig University of Applied Sciences. He received his M.Sc. in Computer Science in 2007. He is senior research engineer and project manager at the Competence Center Future Applications and Media FAME at Fraunhofer Institute for Open Communication Systems FOKUS in Berlin. Robert Kleinfeld was local chair of the 10th European Interactive TV Conference – EuroITV 2012 in Berlin (hosted by Fraunhofer FOKUS). Robert Kleinfeld is involved in multiple international and national projects (PADGETS, webinos, OPENi and COMPOSE) within the area of: Social Media Computing, Cloud-based Services and Next Generation Web Platforms for Multiscreen Applications

Information

Participant Requirements

• Mac Intel, Windows or Linux Computer capable of launching VirtualBox images. Ensure that you have the latest version of VirtualBox installed on your machine (https://www.virtualbox.org/wiki/Downloads)
• Smartphone with Android, minimum 4.1
• Ability and disk space to download and install additional software

Participant Recommendations

All you will need to know is a basic knowledge of HTML, CSS and JavaScript. This not a hard requirement, but will help in really understanding what is going on, rather than just copying the code into your project.

Registration

Codemotion Berlin Sign Up

When

Saturday 11 May 2013

Where

Codemotion will take place at the Hochschule für Technik und Wirtschaft (HTW), University of Applied Sciences in Building G & FKI.

Wilhelminenhofstraße 75A
12459 Berlin
City Map
How to reach HTW with Public Transport

Venue: Fraunhofer webinos Lab

Time

2pm-4pm

Language

The workshop will be in English

Workshop Duration

2 Hours

Contact

For further information please contact Robert Kleinfeld: robert.kleinfeld@fokus.fraunhofer.de