Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

arstechnica.com

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#51

Post by Waterluvian »

yjftsjthsd-h wrote: post #50
vessenes wrote: post #25

This is a solid attack. I wouldn't call it beautiful, it's more like a well-considered thorough engineering tour-de-force. I'm horrified but applaud the team. Here's how it works: a stack of SVG filters is created. These filters are constructed so that they will tend to be faster processing a dark pixel than they will be processing a light pixel. An iframe is loaded up by the attacking site, pointing at, say, a banki…

> Here's how it works: a stack of SVG filters is created. These filters are constructed so that they will tend to be faster processing a dark pixel than they will be processing a light pixel. Why/how is that a thing? I know I'm ignorant, but I would natively expect the processing to be a deterministic series of mathematical operations that don't really care what values get fed through. Edit: Is it something about bra…

Not sure. But web implementations are often highly optimized given just how much they get run. Perhaps one of the filters short circuits and does no work on black pixels because, I dunno, what’s a Gaussian blur of a white circle on a white background?

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#52

Post by ryukoposting »

cosmotic wrote: post #10
tedunangst wrote: post #4

But is it really stealing if the owner isn't deprived of use? It's just costless duplication of a nonscarce resource.

It takes ~1hour to grab an unspecified portion of the screen (screenshots show a tiny 100x100 or so box). I'd say not costless.

Imagine you're a shady streaming site running tons of shady ads. Now imagine one of your shady advertisers loads a shady iframe using this exploit. The targeted user keeps that tab open for a few hours- they're watching a show, after all. As the streaming site loading the add, you're none the wiser.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#54

Post by comex »

yjftsjthsd-h wrote: post #50
vessenes wrote: post #25

This is a solid attack. I wouldn't call it beautiful, it's more like a well-considered thorough engineering tour-de-force. I'm horrified but applaud the team. Here's how it works: a stack of SVG filters is created. These filters are constructed so that they will tend to be faster processing a dark pixel than they will be processing a light pixel. An iframe is loaded up by the attacking site, pointing at, say, a banki…

> Here's how it works: a stack of SVG filters is created. These filters are constructed so that they will tend to be faster processing a dark pixel than they will be processing a light pixel. Why/how is that a thing? I know I'm ignorant, but I would natively expect the processing to be a deterministic series of mathematical operations that don't really care what values get fed through. Edit: Is it something about bra…

It’s based on compression. The paper explains how the GPU stores pixels in memory in a losslessly compressed format in order to speed up data transfers. And the filter stack is designed so that a dark pixel input produces an all-black output (very compressible), while a light pixel input produces noise as output (very incompressible).

Link to original paper:

https://www.hertzbleed.com/gpu.zip/GPU-zip.pdf

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#55

Post by taberiand »

drug-freedom wrote: post #38
wolpoli wrote: post #37

Earlier quoted context omitted.

Does anyone know the use case for cross-site CSS/SVG filters and who would need even need it?

For example you want to display a small blurred thumbnail of an iframe.

Perhaps some things we just shouldn't be allowed to do

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#56

Post by hakre »

Isn't using GPU and hardware acceleration considered experimental in browsers and the safe default to disable such features for day-to-day use?

Not saying to make this achievement smaller than it is, quite the opposite, it's important there is more such research.

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#58

Post by baz00 »

AlexCoventry wrote: post #24
baz00 wrote: post #15

We should have never gone past Gopher :)

What is it with these strangers who want to run stuff on my computer without my explicit permission?? :-)

Exactly!

If I want to run something on my computer I’ll damn well download a tar file and spend several hours arguing with autoconf! :)

Re: Sidechannel pixel-stealing attack works in Chromium on all modern GPUs

#60

Post by jethack »

hakre wrote: post #56

Isn't using GPU and hardware acceleration considered experimental in browsers and the safe default to disable such features for day-to-day use? Not saying to make this achievement smaller than it is, quite the opposite, it's important there is more such research.

No, these features have been enabled by default for a decade+ on every platform that isn't desktop Linux, including such modern browsers as IE9
Post reply on HN