Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A CSS Keylogger

github.com

Post reply on HN
Print view View original

11–20 of 173 posts

Re: Show HN: A CSS Keylogger

#11

Post by maxchehab »

rickdmer wrote: post #3

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

Author here. I believe the injection of the css in the chrome extension will only work in newer versions of chrome. However the "attack" would still work for all browsers. :)

Re: Show HN: A CSS Keylogger

#12

Post by akincisor »

rickdmer wrote: post #3

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

I think it would work against password managers like LastPass which fill in passwords using JS.

Re: Show HN: A CSS Keylogger

#13

Post by maxchehab »

Raphmedia wrote: post #8

I can't seem to make it work from a web page. Perhaps it's for extensions only? https://jsfiddle.net/tdwsw6zo/3/

Your background-image url must be an endpoint that can process a request. Simply, requesting a placehold.it/a image is pointless, but sending to l33thacker.com/a, assuming that l33thacker.com knows how to process that request maliciously, will work.

Re: Show HN: A CSS Keylogger

#14

Post by Karawebnetwork »

rickdmer wrote: post #10
Raphmedia wrote: post #8

I can't seem to make it work from a web page. Perhaps it's for extensions only? https://jsfiddle.net/tdwsw6zo/3/

The input has to have the "value" set in the HTML. https://jsfiddle.net/tdwsw6zo/4/

Well, yes of course but that's simply an attribute selector parsing the raw HTML.

This can be done with any attribute:

input[type="password"][hackernews$="isthebestwebsite"] { background-image: url("http://placehold.it/15x15?text=h4x0r"); }

That's not a keylogger at all, the data is already printed in the HTML source.

Re: Show HN: A CSS Keylogger

#17

Post by jandrese »

Raphmedia wrote: post #9
jandrese wrote: post #4

CSS has gone too far. At least when I'm worried about a nasty javascript attack from a site I can be somewhat reassured that noscript/umatrix will work. Am I going to have to start whitelisting CSS now too? Am I too late?

You are. CSS has gone "too far" the second it allowed linking to images. I can simply background-image:url("myTrackingPixel.png") and then track whenever someone tries to load that image from my server.

It drives me crazy when I see someone has implemented Doom in CSS, but it still requires black magic to do a simple responsive three column layout without using bleeding edge features that aren't widely supported yet.

Re: Show HN: A CSS Keylogger

#18

Post by sachleen »

You'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute.

The original post on this talks about it in more detail:

https://www.mike-gualtieri.com/posts/stealing-data-with-css-...

Summary: A method is detailed - dubbed CSS Exfil - which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. Due to the modern web's heavy reliance on CSS, a wide variety of data is potentially at risk, including: usernames, passwords, and sensitive data such as date of birth, social security numbers, and credit card numbers. The technique can also be used to de-anonymize users on dark nets like Tor. Defense methods are discussed for both website operators as well as web users, and a pair of browser extensions are offered which guard against this class of attack.

Post reply on HN