VisibleV8

Overview

strace for the web

VisibleV8 (VV8) is a custom variant of the V8 JavaScript engine at the heart of the Chromium browser, the Node.js application runtime, and probably other titans of the modern software world. Maintained and distributed as a minimally-invasive and maintainable patchset, VV8 captures and logs the following activities in plaintext logs:

• All JS function calls that cross the JS/hosting-application boundary (i.e., calls to what V8 internally dubs “API” functions, like window.alert in a browser)
• Named (e.g., foo.bar) or keyed (e.g., foo["bar"]) property lookups for which the receiver (e.g., foo) refers to an object defined by the hosting application or the global object
• Assignments to named or keyed property expressions involving receiver objects defined by the hosting application (or the global object)
• Reflect.get and Reflect.set API access to properties on hosting application-defined objects

Log records directly or indirectly include the following context:

• Source code of the immediately active/invoking script
• Simple provenance details of active script (i.e., source URL or eval-ing script)
• Character offset of function call/property access within active script
• Receiver type information (i.e., constructor/prototype function name)
• Property/function name
• Value (for primitive values) or type information (for objects) passed to function calls as arguments or as the new property value for property assignments

Papers

1. FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques
   Nikolaos Pantelaios, Alexandros Kapravelos
   Proceedings of the USENIX Security Symposium, 2024
   [PDF] [Bibtex] [code]

   ×

   @inproceedings{fv8-sec24,
     title = {{FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques}},
     author = {Pantelaios, Nikolaos and Kapravelos, Alexandros},
     booktitle = {{Proceedings of the USENIX Security Symposium}},
     code = {{https://github.com/wspr-ncsu/FV8}},
     month = aug,
     tag = {vv8},
     year = {2024}
   }
   

2. Automatic Discovery of Emerging Browser Fingerprinting Techniques
   Junhua Su, Alexandros Kapravelos
   Proceedings of The Web Conference (WWW), 2023
   [PDF] [Bibtex] [code]

   ×

   @inproceedings{fptechniques-www23,
     title = {{Automatic Discovery of Emerging Browser Fingerprinting Techniques}},
     author = {Su, Junhua and Kapravelos, Alexandros},
     booktitle = {{Proceedings of The Web Conference (WWW)}},
     month = apr,
     code = {{https://github.com/wspr-ncsu/BrowserFingerprintingAD}},
     pages = {2178--2188},
     tag = {vv8},
     year = {2023}
   }
   

3. Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy
   Seyed Ali Akhavani, Jordan Jueckstock, Junhua Su, Alexandros Kapravelos, Engin Kirda, Long Lu
   Proceedings of the Information Security Conference (ISC), 2021
   [PDF] [Bibtex]

   ×

   @inproceedings{browserprint-isc21,
     title = {{Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy}},
     author = {Akhavani, Seyed Ali and Jueckstock, Jordan and Su, Junhua and Kapravelos, Alexandros and Kirda, Engin and Lu, Long},
     booktitle = {{Proceedings of the Information Security Conference (ISC)}},
     pages = {161--176},
     month = nov,
     tag = {vv8},
     year = {2021}
   }
   

4. Towards Realistic and Reproducible Web Crawl Measurements
   Jordan Jueckstock, Shaown Sarker, Peter Snyder, Aidan Beggs, Panagiotis Papadopoulos, Matteo Varvello, Ben Livshits, Alexandros Kapravelos
   Proceedings of The Web Conference (WWW), 2021
   [PDF] [Bibtex] [code]

   ×

   @inproceedings{vpc-www21,
     title = {{Towards Realistic and Reproducible Web Crawl Measurements}},
     author = {Jueckstock, Jordan and Sarker, Shaown and Snyder, Peter and Beggs, Aidan and Papadopoulos, Panagiotis and Varvello, Matteo and Livshits, Ben and Kapravelos, Alexandros},
     booktitle = {{Proceedings of The Web Conference (WWW)}},
     code = {{https://github.com/wspr-ncsu/reprocrawl-code-release}},
     pages = {80–91},
     numpages = {13},
     month = apr,
     tag = {vv8},
     year = {2021}
   }
   

5. Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage
   Shaown Sarker, Jordan Jueckstock, Alexandros Kapravelos
   Proceedings of the ACM Internet Measurement Conference (IMC), 2020
   [PDF] [Bibtex]

   ×

   @inproceedings{jsobf-imc20,
     title = {{Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage}},
     author = {Sarker, Shaown and Jueckstock, Jordan and Kapravelos, Alexandros},
     booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}},
     pages = {648–661},
     month = oct,
     tag = {vv8},
     year = {2020}
   }
   

6. VisibleV8: In-browser Monitoring of JavaScript in the Wild
   Jordan Jueckstock, Alexandros Kapravelos
   Proceedings of the ACM Internet Measurement Conference (IMC), 2019
   [PDF] [Bibtex] [website] [slides] [talk] [code]

   ×

   @inproceedings{vv8-imc19,
     title = {{VisibleV8: In-browser Monitoring of JavaScript in the Wild}},
     author = {Jueckstock, Jordan and Kapravelos, Alexandros},
     booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}},
     pages = {393–405},
     month = oct,
     howpublished = {/projects/vv8/},
     code = {{https://github.com/wspr-ncsu/visiblev8}},
     slides = {/presentations/vv8-imc19.pdf},
     talk = {https://vimeo.com/showcase/6531379/video/369121825#t=3500s},
     tag = {vv8},
     year = {2019}
   }
   

Availability

The VV8 patches, tests, build scripts, and documentation are all available on GitHub.