Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Timing attack against HSTS to sniff browser history in Chrome and Firefox

zyan.scripts.mit.edu

Post reply on HN
Print view View original

51–60 of 99 posts

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#51

Post by kentonv »

desdiv wrote: post #49
kentonv wrote: post #28

Earlier quoted context omitted.

The results never leave your browser, though, so there's not much to worry about.

The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation, since you don't have a copy of the JS code that was sent to hobs' browser.

Actually I can. The author of this code is a friend of mine who works with the EFF, and the idea that she's secretly sending malicious scripts to some people but not others from her MIT web hosting space under her own name is simply not plausible.

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#52

Post by ejcx »

meowface wrote: post #50
ejcx wrote: post #27

Earlier quoted context omitted.

No. Leaks were known far beyond the "supercookie", but attacks were not as high quality as these.

Could you link some older sources discussing some of these leaks? I'm having trouble finding any. Not doubting you, since you're probably right; would just be interested in reading them.

AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1].

That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that reporting can cause unwanted information leakage, but I didn't find it in the security considerations with a quick control+f just now.

[0] - https://lists.w3.org/Archives/Public/public-webappsec/2015Ju...

[1] - http://homakov.blogspot.com/2014/01/using-content-security-p...

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#53

Post by robzyb »

desdiv wrote: post #49
kentonv wrote: post #28

Earlier quoted context omitted.

The results never leave your browser, though, so there's not much to worry about.

The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation, since you don't have a copy of the JS code that was sent to hobs' browser.

> The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation [...]

But if that's the case then you shouldn't click on anything on HN.

I would argue that it is A-OK to post this link directly on hackernews.

It just says "look at what your browser can do! imagine if blackhats took advantage of this."

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#54

Post by meowface »

ejcx wrote: post #52
meowface wrote: post #50

Earlier quoted context omitted.

Could you link some older sources discussing some of these leaks? I'm having trouble finding any. Not doubting you, since you're probably right; would just be interested in reading them.

AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1]. That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that r…

Ah, I feel silly now. I remember reading Egor's blog post on that last year.

Thanks.

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#55

Post by bcrypt »

desdiv wrote: post #49
kentonv wrote: post #28

Earlier quoted context omitted.

The results never leave your browser, though, so there's not much to worry about.

The JS code sent to kentonv's browser might be safe, but you can't really meaningfully comment on hobs' situation, since you don't have a copy of the JS code that was sent to hobs' browser.

In any case, I didn't minify or remove comments, so you can just view-source:http://zyan.scripts.mit.edu/sniffly/index.js

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#56

Post by bcrypt »

ejcx wrote: post #52
meowface wrote: post #50

Earlier quoted context omitted.

Could you link some older sources discussing some of these leaks? I'm having trouble finding any. Not doubting you, since you're probably right; would just be interested in reading them.

AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1]. That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that r…

In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for!

In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#57

Post by heretek »

hobs wrote: post #2

Probably a good idea to edit the title to indicate that this is an example attack site as well, not my favorite thing in general to land on without warning. No js seems to mean no worries though.

While I probably would have linked HN to the slides instead of the site, I do think calling it an attack site is paranoid and disingenuous.

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#58

Post by elangelcentral »

bcrypt wrote: post #47
Tinyyy wrote: post #8

How much of this is accurate, and how much of this is simply the top XXX sites that people visit?

I pulled the list of domains out of the Alexa Top 1M plus some domains that my friends run. But I'm not biasing results towards showing up as visited by popularity or anything like that. I didn't set up analytics to figure out how accurate results are for the average person; having manually checked with a few people's browsers, I'd say the accuracy rate is ~75%.

At a glance, looks about 75% accurate for me. But what really freaked me out is that it correctly flagged a financial institution (not a major one) where I have an account yet feel pretty sure I haven't visited the website in months.

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#59

Post by ejcx »

bcrypt wrote: post #56
ejcx wrote: post #52

Earlier quoted context omitted.

AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1]. That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that r…

In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for! In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs

like you said, the security considerations are mostly theoretical. It actually might seem basic turning it into a real attack but it requires a fair bit of work.

It is always my favorite section of the RFCs. Along with anywhere that says "The UA [MUST|MAY|...] \w+". Much fun to be had....

Re: Timing attack against HSTS to sniff browser history in Chrome and Firefox

#60

Post by zmanian »

The site attacks seems to fail in Tor Browser. It returns a list of sites that have nothing to do with my browser history. Probably because Tor Browser reduces the time precision.[1]

It seems like it would be nice to require some sort of user privilege escalation like accessing location, or webcam to access high precision timing. This would close off a huge class of time related side channels.

[1]https://trac.torproject.org/projects/tor/ticket/1517

Post reply on HN