Live data from Hacker News

This JavaScript can snoop on other browser tabs to work out what you're visiting

theregister.co.uk

11–20 of 68 posts

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#11
post #6

Not sure if I understand this correctly, but the attacker's JS must load the pages in question to see if they are in cache, right? Wouldn't that put also them in cache, which means that next time this technique is used it will not work? Even more, there is now plausible deniability: "I never saw these pages, I guess some JS must have been snooping around and put them to my cache..." And the logical workaround is disa…

> And the logical workaround is disabling cache,...

The attack uses the CPU cache, not the browser cache.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#12

> The takeaway, they contend, is that anything short of running a single browser tab at any one point in time poses a privacy risk: if you open a second tab, JavaScript in it can snoop on the other tab. Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. Firefox Focus [1], my most used browser (single tab only), seems to be safe from t…

My Firefox Klar (Focus in German market) does have multiple tabs. But since the entire application is shorter-lived, I never tend to have many tabs open.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#13
Reading the paper it seems that this effectively messes with the cache to see how much it's being accessed generally, and based on that access pattern creates a fingerprint that can be matched against the way another website uses the cache generally.

Presumably, having several tabs open makes it pretty hard to distinguish one site through the noise. Unless it's Slack, then the fingerprint looks like a giant blob of constant data access...I jest I jest.

From the paper:

The main difference is that the Prime+Probe attack measures contentions in specific cache sets, whereas our attack measures contention over the whole cache. Specifically, our JavaScript attack allocates an LLCsized buffer and measures the time to access the entire buffer.

The victim’s access to memory evicts the contents of our buffer from the cache, introducing delays for our access. Thus, the time to access our buffer is roughly proportional to the number of cache lines that the victim uses.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#14

> The takeaway, they contend, is that anything short of running a single browser tab at any one point in time poses a privacy risk: if you open a second tab, JavaScript in it can snoop on the other tab. Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. Firefox Focus [1], my most used browser (single tab only), seems to be safe from t…

Firefox Focus does have multiple tabs - long press on a link, then select "Open link in new tab".

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#16
It's always the cache. Caches are evil! (security) No! Caches are amazing (speed). Fun fact: I never understood caches that well, until I learned about geo-caching and learned what caches were used for back in the day of yore!

Inclusive caches are a huge culprit security wise. If you can perform any variation on the clflush instruction by building eviction sets [1] then you are good to go to perform somekind of operation you're not allowed to do.

I feel that processor vendors are using their undocumented security by obscurity too much. Though I don't know if they do it intentionally or that these things happen merely via company processes and it's just tough to build a reliable safe processor.

Safe cache design simply ain't easy, not even in 2018. The hype is attacking inclusive caches in most cache attacks, but even when you build other things, hardware hackers will basically look at the computer schematics of everything again and they'll ask themselves how they're able to get that nice primitive back of inclusive caches [2].

[1] Algorithmically defined memory addresses that will kick your target cacheline out by flooding the same space.

[2] The primitive is: an inclusive cache by current design standards has a shared last level cache. Kick target cachelines out there and you're flushing a part of private caches from other processor cores as well.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#17
post #9

I always thought timing in JS was very imprecise, so "timing attacks" wouldn't work!?

This particular attack doesn't rely on high-precision timing, or cache layout. It measures CPU cache latency, and that's enough to create a fingerprint.

If JS still had high-precision timing, then side-channel attacks with better information resolution are possible.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#18
post #6

Not sure if I understand this correctly, but the attacker's JS must load the pages in question to see if they are in cache, right? Wouldn't that put also them in cache, which means that next time this technique is used it will not work? Even more, there is now plausible deniability: "I never saw these pages, I guess some JS must have been snooping around and put them to my cache..." And the logical workaround is disa…

Fun fact: JavaScript is fast enough to muck around with cpu caches if you know how.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#19
post #3

I think it would be more appropriate to link the paper[1] and use its title (as it's much more descriptive). [1] https://arxiv.org/abs/1811.07153 Robust Website Fingerprinting Through the Cache Occupancy Channel

Leave it to The Register to clickbait the research. This is nothing new btw. Side-channel attacks on other tabs have been known for more than a decade, and is one of the legitimate reasons why the NoScript plugin was developed, among others.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#20

It's always the cache. Caches are evil! (security) No! Caches are amazing (speed). Fun fact: I never understood caches that well, until I learned about geo-caching and learned what caches were used for back in the day of yore! Inclusive caches are a huge culprit security wise. If you can perform any variation on the clflush instruction by building eviction sets [1] then you are good to go to perform somekind of opera…

I wouldn't say caches are evil. Shared caches are.
Post reply on HN