Korean research team proves security risks of right-clicking links, using split view
A Unist research team became the first from Korea to win the Internet Defense Prize at the 35th Usenex Security Symposium for discovering bugs.
The sign of Ulsan National Institute of Science and Technology, or Unist, located in Ulsan
UNIST
A research team from Unist became the first Korean team to win the Internet Defense Prize at the 35th Usenex Security Symposium for proving that opening a new internet browser tab or dividing the browser window with a split view can trigger bugs.
The research paper titled “BUIzz: Finding Policy Enforcement Bugs via Interaction Simulation on the Browser User Interface,” focused on how browsers’ security measures often overlook bugs triggered by how ordinary users use online browsers.
The report said that even simple actions such as right-clicking a link can lead to an unexpected bug. Duplicating tabs, or opening the link sidebar or using a split-view window can also reportedly trigger bugs.
The program identified 35 security bugs and three functional bugs across six different browsers, such as Chrome and Firefox, according to the team’s paper.
“Our reports have led to fixes for 14 security bugs, resulting in seven CVEs [Common Vulnerabilities and Exposures] and $14,700 in bug bounties,” read the paper.
CVE is a free, standardized system for identifying and tracking down publicly known cybersecurity vulnerabilities.
The Internet Defense Prize — funded by Meta — recognizes research that creates more secure internet environments. Only three teams have won the award this year, and the Unist team became the first Korean team to take home the honor since the prize was established in 2014.
The four-person research team was led by Prof. Wi Seong-gil with researcher Jung Ming-gi as the lead author. The team presented their discovery during the 35th Usenix Security Symposium held in Baltimore from Wednesday to Friday.
The annual symposium brings together programmers and researchers who are committed to advancing the security and privacy of computer systems and networks. More than 3,000 research papers were reportedly submitted for this year’s symposium, only 362 of which were selected.
The Unist team is expected to receive $25,000 in research funding as part of the win. The paper has also been recognized as one of 22 papers selected for this year’s symposium’s runners-up list for its paper awards.
BY LEE JI-WON [lee.jiwon10@joongang.co.kr]
