Introducing Snow βοΈ [π]
04 Jan 2023Originally posted on X
Excited to introduce the experimental β οΈ #LavaMoat π toolbox technology,
Snow JS βοΈ
𧡠Snow is an advanced and an important solution to a complicated sub problem in #browser #javascript #SupplyChainAttacks #security:
But first, get yourself familiar with the field of realms security by reading my previous tweet in order to understand the problem before we dive into the solution:
So if to sum up the problem, we have many advanced browser JS security tools/services trying to apply protection to web apps by hooking into different browser builtin APIs with defense mechanisms that can be bypassed a good amount of the times by using same origin realms (iframe)
How so? If for example I create a tool that hooks into the "document.cookie" descriptor to block JS access to cookies for a made up security reason, malicious code can easily still access those cookies by creating an iframe and use the "document.cookie" descriptor from within it:
Why is this a problem? Because in the example above that's just one way to form a new same origin realm, but there are many other ways to do that. So if we wish to automatically defend all future realms we'd have to treat all possible ways to create them - attackers only need one
So obviously this is a hard problem to solve.
Automatically apply certain code not only to the top main realm, but to all potential child realms, immediately at the creation stage of a realm to prevent attackers from abusing them - is a hard need to accomplish.
Enters SnowJS βοΈ
Snow attempts to accomplish just that!
It provides a simple API that when given a callback invokes it with every newborn realm in the web app.
Meaning, it allows you to synchronously hook into the rising moment of every new realm in the web app and manipulate it as you wish.
In contrast to how simple Snowβs API is, it does a lot of complicated work in making sure creation of new realms cannot be accomplished without going through Snow first.
By putting security first, Snow does its best at:
1. Hooking every possible way of creating new realms;
2. Getting a hold on new realms before any other JS code in runtime has the chance to.
To put simply, this means Snow does a hard work in preventing anyone from creating new iframes and accessing their new window object before Snow does.
Now that we understand what Snow is, itβs clear how we can use it to solve the sub problem thatβs described in the thread above:
Basically we can take any protection tool/service out there and instead of running it on the top main realm only, use Snow to apply itself to all potential newborn child realms - as simple as that!
Same goes for our "cookie protector" example from before:
I made sure there is a massive amount of information about Snow, so if you want to learn more about the project, the motivation behind it, the problem it tries to solve and more, it's all documented and continently updated here: so give it a look!
I will continue to talk about Snow and attempt to further explain it down the road, to make sure you're as excited about it as I am if you're not convinced yet π
Remember: Snow is still experimental β οΈ and might still not be bulletproof as this is a very hard problem to solve!
Snow JS βοΈ
𧡠Snow is an advanced and an important solution to a complicated sub problem in #browser #javascript #SupplyChainAttacks #security:
But first, get yourself familiar with the field of realms security by reading my previous tweet in order to understand the problem before we dive into the solution:
So if to sum up the problem, we have many advanced browser JS security tools/services trying to apply protection to web apps by hooking into different browser builtin APIs with defense mechanisms that can be bypassed a good amount of the times by using same origin realms (iframe)
How so? If for example I create a tool that hooks into the "document.cookie" descriptor to block JS access to cookies for a made up security reason, malicious code can easily still access those cookies by creating an iframe and use the "document.cookie" descriptor from within it:
Why is this a problem? Because in the example above that's just one way to form a new same origin realm, but there are many other ways to do that. So if we wish to automatically defend all future realms we'd have to treat all possible ways to create them - attackers only need one
So obviously this is a hard problem to solve.
Automatically apply certain code not only to the top main realm, but to all potential child realms, immediately at the creation stage of a realm to prevent attackers from abusing them - is a hard need to accomplish.
Enters SnowJS βοΈ
Snow attempts to accomplish just that!
It provides a simple API that when given a callback invokes it with every newborn realm in the web app.
Meaning, it allows you to synchronously hook into the rising moment of every new realm in the web app and manipulate it as you wish.
In contrast to how simple Snowβs API is, it does a lot of complicated work in making sure creation of new realms cannot be accomplished without going through Snow first.
By putting security first, Snow does its best at:
1. Hooking every possible way of creating new realms;
2. Getting a hold on new realms before any other JS code in runtime has the chance to.
To put simply, this means Snow does a hard work in preventing anyone from creating new iframes and accessing their new window object before Snow does.
Now that we understand what Snow is, itβs clear how we can use it to solve the sub problem thatβs described in the thread above:
Basically we can take any protection tool/service out there and instead of running it on the top main realm only, use Snow to apply itself to all potential newborn child realms - as simple as that!
Same goes for our "cookie protector" example from before:
I made sure there is a massive amount of information about Snow, so if you want to learn more about the project, the motivation behind it, the problem it tries to solve and more, it's all documented and continently updated here: so give it a look!
I will continue to talk about Snow and attempt to further explain it down the road, to make sure you're as excited about it as I am if you're not convinced yet π
Remember: Snow is still experimental β οΈ and might still not be bulletproof as this is a very hard problem to solve!