Live data from Hacker News

Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

arstechnica.com

31–40 of 71 posts

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#31
post #26

This is a solid attack. I wouldn't call it beautiful, it's more like a well-considered thorough engineering tour-de-force. I'm horrified but applaud the team. Here's how it works: a stack of SVG filters is created. These filters are constructed so that they will tend to be faster processing a dark pixel than they will be processing a light pixel. An iframe is loaded up by the attacking site, pointing at, say, a banki…

I love 3d graphics on the web but man it seems to be an infinite security hole

In this case it's SVG and not WebGL or CSS 3D that is the problem here. Even without hardware acceleration the SVG filters would still probably expose timing data

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#32
post #28

Earlier quoted context omitted.

In this case it's because Chrome supports a relatively obscure use case (GPU-accelerated CSS filters on a cross-origin iframe), it's not really a bug or a vulnerability in the browser.

You seem knowledgeable on this. Why is only chrome supporting this feature and other browsers aren’t? Was this feature pushed by the chrome team? As for your second point, how is this not a vulnerability in the browser? The security intent is clear, a page should not be able to inspect an iframe. I can’t take a screenshot and read the pixels of the iframe. The fact the chromium supports a published standard is irrele…

Interesting points. However, I think the reasons are much simpler: why wouldn't you want accelerated CSS in your browser, including cross-origin iframes?

Browsers have been making use of GPUs for a long time. It's faster than the CPU and saves battery

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#33
post #28

Earlier quoted context omitted.

In this case it's because Chrome supports a relatively obscure use case (GPU-accelerated CSS filters on a cross-origin iframe), it's not really a bug or a vulnerability in the browser.

You seem knowledgeable on this. Why is only chrome supporting this feature and other browsers aren’t? Was this feature pushed by the chrome team? As for your second point, how is this not a vulnerability in the browser? The security intent is clear, a page should not be able to inspect an iframe. I can’t take a screenshot and read the pixels of the iframe. The fact the chromium supports a published standard is irrele…

I don't have any reason to believe that the Chrome team pushed for this use case specifically. In the past when I experimented with SVG filters their feature support was already very different across Trident Edge, Chrome, and Firefox, as was their implementation (hardware accelerated vs not). SVG filters are very powerful and also very slow, and not necessarily constant-time, so they're a good target if you're trying to execute a timing attack. (For whatever reason, my old JSIL project actually happened to use SVG filters to accelerate a specific use case...)

I think it would be fair to call it an oversight that Chromium allows cross-origin use of the features involved in this attack, but it doesn't really feel like a vulnerability in the traditional sense to me - everything is working as intended/specified AFAIK. It just happens to expose a timing attack. The reality is that tons of things are potential timing attacks and if every single feature that might get used for one was disabled in advance the web platform would be pretty useless.

There are various constraints you could apply to make attacks like this harder - i.e. limiting filter stacks to say 4 items, limiting use of filters cross-origin - but I find it understandable that such things didn't happen. This functionality is probably also quite old so it's possible nobody was taking timing attacks quite as seriously back then.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#34
post #28

Earlier quoted context omitted.

You seem knowledgeable on this. Why is only chrome supporting this feature and other browsers aren’t? Was this feature pushed by the chrome team? As for your second point, how is this not a vulnerability in the browser? The security intent is clear, a page should not be able to inspect an iframe. I can’t take a screenshot and read the pixels of the iframe. The fact the chromium supports a published standard is irrele…

Interesting points. However, I think the reasons are much simpler: why wouldn't you want accelerated CSS in your browser, including cross-origin iframes? Browsers have been making use of GPUs for a long time. It's faster than the CPU and saves battery

Yes, between the device with hardware accelerated rendering and the device without, the user is likely going to prefer the former because software implementations are much slower and much more power-hungry. Thankfully SVG/CSS filters aren't used a ton on the web but usage has probably crawled up over time - I know many websites now use CSS blur filters.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#35
post #17

Earlier quoted context omitted.

In this case it's because Chrome supports a relatively obscure use case (GPU-accelerated CSS filters on a cross-origin iframe), it's not really a bug or a vulnerability in the browser.

Seems like the root reason for wanting accelerated CSS on cross-origin iframe is for flashy/fancy embeds...like, IDK, ads or something?

At the point where you're rasterizing, the distinction between same-origin and cross-origin is not necessarily present. It's possible this just works because it happened to work, and nobody ever went out of their way to implement it.

i.e. the display list for the page has some boxes for iframes, and those boxes are identical to the rasterizer regardless of what origin they're from, so it happily applies filters to all of the iframes.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#36

Earlier quoted context omitted.

The word is used to refer to taking something without the right to do so. The key part is the lack of a right to do so, not depriving the owner. e.g. If you take someone's car while they're away on vacation and bring it back before they get home, it is still stealing, even if you topped up the tank and they never noticed.

Analogies never work. The reason that it is wrong to take my car, even if I don’t notice, are multiple: - You are still depriving me of the possibility of using my own car, even if it happened to be the case that I didn’t need it. I could have come home early. I could have told some friend or family to pick up my car so that they could use it. I could have had an appointment that someone would come by to service my c…

It was an example of the use of the word, not an analogy. If you'd like some examples when used with intangibles, here's a few of those:

"They stole my idea"

"He stole my identity"

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#37

Earlier quoted context omitted.

Why isn't the proposed fix "don't allow cross-site iframe injection"? It is surely a security risk that other browsers have taken that stand on no?

disabling CSS/SVG filters for cross-site content also seems like a pretty reasonable thing to do

Does anyone know the use case for cross-site CSS/SVG filters and who would need even need it?

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#38
post #37

Earlier quoted context omitted.

disabling CSS/SVG filters for cross-site content also seems like a pretty reasonable thing to do

Does anyone know the use case for cross-site CSS/SVG filters and who would need even need it?

For example you want to display a small blurred thumbnail of an iframe.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#39
post #28

Earlier quoted context omitted.

You seem knowledgeable on this. Why is only chrome supporting this feature and other browsers aren’t? Was this feature pushed by the chrome team? As for your second point, how is this not a vulnerability in the browser? The security intent is clear, a page should not be able to inspect an iframe. I can’t take a screenshot and read the pixels of the iframe. The fact the chromium supports a published standard is irrele…

I don't have any reason to believe that the Chrome team pushed for this use case specifically. In the past when I experimented with SVG filters their feature support was already very different across Trident Edge, Chrome, and Firefox, as was their implementation (hardware accelerated vs not). SVG filters are very powerful and also very slow, and not necessarily constant-time, so they're a good target if you're trying…

> The reality is that tons of things are potential timing attacks and if every single feature that might get used for one was disabled in advance the web platform would be pretty useless.

I feel like the web platform would be much more useful if I didn't have to constantly worry about drive-by attacks leveraging bugs in a giant stack of "web technologies" that are only getting more complex with each passing year.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#40
post #13

Could we, like, do away with iframes?

Please delete JavaScript while we're at it.

JavaScript tends to be fine in specific allow-listed circumstances:

  * User preference (E.G. plugins/extensions)
  * Native to the site, when a user is logged in
  * Trivial and sandboxed to page local data
I recall how I used to use Flash, with a plugin that delayed the loading until AFTER I hit 'play' on the plugin frame.

I suspect that's the sort of security framework that will solve a lot of the problems. Do not run untrusted code by default. Have the user to enable a site (often during account creation / sign in on a new device). Have the user 'click play' if they expect something to work.

Make sites that just work without client side code again.

Post reply on HN