Are timing attacks over the internet affected by buffer bloat?
Not a single positive even though I have visited a number of the sites on the list. There's even tabs open for Reddit right now.
Timing attack against HSTS to sniff browser history in Chrome and Firefox
11–20 of 99 posts
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#12This approach is rather interesting.
But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#13Mitigation, get your site added to the HSTS Preload list.
Most of the advanced webappsec security features leak information. CSP, HPKP, HSTS, etc, which was all 100% known.
This talk is excellent because it puts together the attacks into real PoCs, real attacks, and great information on how it all works. These attacks in the talk are quality too, instead of being 'mostly' theoretical.
This wasn't really documented all in one place, or as high quality in the past. Way to go @bcrypt. High quality work.
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#14A different version of this would of been to mess around with the :visited css selector since it's assuming a list of domains that you probably visit
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#15This approach is rather interesting. But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?
You used to be able to do that, but it was fixed in 2010: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#16This approach is rather interesting. But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?
Yes, this attack was demoed to work several years ago but has been patched as far as I know:
https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...
"The first change is that Gecko will lie to web applications under certain circumstances. In particular, getComputedStyle() and similar functions such as element.querySelector() always return values indicating that a user has never visited any of the links on a page."
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#17A different version of this would of been to mess around with the :visited css selector since it's assuming a list of domains that you probably visit
This has mostly been fixed.
See http://dbaron.org/mozilla/visited-privacy and https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#18Thankfully, this particular attack does not work with a running µmatrix. I do see a bunch of image requests to all these domains, but it shows that I haven't visited any (except for the ones that are blocked completely by hosts files, amusingly enough).
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#19I was skeptical at first, then I visited some of the sites it said I had not visited. A second round caught them, eep! A little machine learning could probably make this much more accurate, the PoC is clear.
Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox
#20Sites you probably haven't visited: "myspace.com" < pffft. That's too easy.