Show HN: A CSS Keylogger

#1

Post by maxchehab » Tue, Feb 20, 2018, 6:37 PM UTC

Show HN: A CSS Keylogger
github.com

Re: Show HN: A CSS Keylogger

#2

Post by jlg23 » Tue, Feb 20, 2018, 6:49 PM UTC

I have not tried it, but if it works (it should): Chapeau, a very neat exploit indeed.

Re: Show HN: A CSS Keylogger

#3

Post by rickdmer » Tue, Feb 20, 2018, 6:49 PM UTC

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs.

Edit: This doesn't seem to work for me in Chrome 63.0.3239.132

Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

Re: Show HN: A CSS Keylogger

#4

Post by jandrese » Tue, Feb 20, 2018, 6:56 PM UTC

CSS has gone too far. At least when I'm worried about a nasty javascript attack from a site I can be somewhat reassured that noscript/umatrix will work. Am I going to have to start whitelisting CSS now too? Am I too late?

Re: Show HN: A CSS Keylogger

#5

Post by orliesaurus » Tue, Feb 20, 2018, 6:57 PM UTC

Why do you have to activate the extension before entering the password?

Re: Show HN: A CSS Keylogger

#6

Post by guntars » Tue, Feb 20, 2018, 7:00 PM UTC

orliesaurus wrote: post #5

Why do you have to activate the extension before entering the password?

Probably to add the css file to the page you're on.

Re: Show HN: A CSS Keylogger

#7

Post by tritium » Tue, Feb 20, 2018, 7:01 PM UTC

To be really dangerous, I think this would need to defeat client-side cache strategies. If the browser caches each resource, the server-side reads wouldn't account for repeated characters or overall length with perfect accuracy. Consider palindromes like "racecar."

This would still put many, if not most, passwords within guessable striking distance, for anyone able to intercept plain-text HTTP traffic, between Alice (the client) and Bob (the CSS image resource server).

Re: Show HN: A CSS Keylogger

#8

Post by Raphmedia » Tue, Feb 20, 2018, 7:01 PM UTC

I can't seem to make it work from a web page. Perhaps it's for extensions only?

https://jsfiddle.net/tdwsw6zo/3/

Re: Show HN: A CSS Keylogger

#9

Post by Raphmedia » Tue, Feb 20, 2018, 7:02 PM UTC

jandrese wrote: post #4

CSS has gone too far. At least when I'm worried about a nasty javascript attack from a site I can be somewhat reassured that noscript/umatrix will work. Am I going to have to start whitelisting CSS now too? Am I too late?

You are. CSS has gone "too far" the second it allowed linking to images.

I can simply background-image:url("myTrackingPixel.png") and then track whenever someone tries to load that image from my server.

Re: Show HN: A CSS Keylogger

#10

Post by rickdmer » Tue, Feb 20, 2018, 7:03 PM UTC

Raphmedia wrote: post #8

I can't seem to make it work from a web page. Perhaps it's for extensions only? https://jsfiddle.net/tdwsw6zo/3/

The input has to have the "value" set in the HTML. https://jsfiddle.net/tdwsw6zo/4/