Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A CSS Keylogger

github.com

Post reply on HN
Print view View original

31–40 of 173 posts

Re: Show HN: A CSS Keylogger

#31

Post by dmitrygr »

dclowd9901 wrote: post #21
rickdmer wrote: post #3

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

So wouldn't that mean, then, that your CSS matchers would have to contain absolutely every permutation of text possible?

No, since it matches only the last character, you watch the requests it makes IN order to get the entire password. As you type "qwerty", it will request "Q", "W", "E", "R", "T", and finally "Y"

no permutations needed

Re: Show HN: A CSS Keylogger

#32

Post by bfred_it »

sachleen wrote: post #18

You'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute. The original post on this talks about it in more detail: https://www.mike-gualtieri.com/posts/stealing-data-with-css-... Summary: A method is detailed - dubbed CSS Exfil - which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. Due to the mod…

In short: this works when the SERVER returns a page with pre-entered information.

This is common when returning to a form you previously filled, like an address for, but it's very, very rare for this to happen to a password field. Like, why would a server send you a password field with your real password pre-entered?

Every other type of data is fair game... given that the attacker can inject CSS into your pages.

Re: Show HN: A CSS Keylogger

#33

Post by theandrewbailey »

tritium wrote: post #7

To be really dangerous, I think this would need to defeat client-side cache strategies. If the browser caches each resource, the server-side reads wouldn't account for repeated characters or overall length with perfect accuracy. Consider palindromes like "racecar." This would still put many, if not most, passwords within guessable striking distance, for anyone able to intercept plain-text HTTP traffic, between Alice…

This might need to defeat backspace, too.

Re: Show HN: A CSS Keylogger

#34

Post by dmitrygr »

Raphmedia wrote: post #28
jandrese wrote: post #17

Earlier quoted context omitted.

It drives me crazy when I see someone has implemented Doom in CSS, but it still requires black magic to do a simple responsive three column layout without using bleeding edge features that aren't widely supported yet.

Browser support (not using Flexbox because of IE) is not that hard once you get your head around it: view-source: http://alistapart.com/d/holygrail/example_3.html http://alistapart.com/d/holygrail/example_3.html

Falls apart entirely on phones (tiny columns of one word wide each, AND horizontal scrolling), so you only proved OP's point...

Re: Show HN: A CSS Keylogger

#35

Post by jaymzcampbell »

sachleen wrote: post #18

You'd have to have all permutations of any length password in the css file AND it would have to be pre-filled using the value attribute. The original post on this talks about it in more detail: https://www.mike-gualtieri.com/posts/stealing-data-with-css-... Summary: A method is detailed - dubbed CSS Exfil - which can be used to steal targeted data using Cascading Style Sheets (CSS) as an attack vector. Due to the mod…

It is using an attribute selector that matches against the last character only - so no giant file of permutations required.

Re: Show HN: A CSS Keylogger

#36

Post by AndrewStephens »

This is neat but doesn't really work as an attack.

The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me.

[edit] Other people pointed this out first.

Also, if you are going to all the trouble of making an extension to inject your evil CSS into a page, why not go the whole hog and inject evil ecmascript instead?

Re: Show HN: A CSS Keylogger

#37

Post by bfred_it »

orliesaurus wrote: post #23
okanesen wrote: post #15

Earlier quoted context omitted.

So you can test the "exploit" obviously.

yes obviously, but in a real world scenario how would that work? Malicious extension loads the CSS file in my current tab and sniffs my password on the attacker's server? Can Chrome extensions load CSS without me having to click/activate them?

The extension is just a way to inject this demo into any site, but extensions that you install can run JavaScript in any site they're allowed to, so this "hack" isn't necessary in that case.

Re: Show HN: A CSS Keylogger

#38

Post by slig »

AndrewStephens wrote: post #36

This is neat but doesn't really work as an attack. The CSS selectors work on the value HtmlNode attribute rather than the Javascript "value" value, which aren't linked normally. The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me. [edit] Other people pointed this out first. Also, if you are going to all the trouble of making an extension…

> The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me

Instagram is a React app and React works that way.

Re: Show HN: A CSS Keylogger

#39

Post by oblosys »

rickdmer wrote: post #3

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

If you use React, updating the value on every change is a very common pattern.

Re: Show HN: A CSS Keylogger

#40

Post by jakobegger »

theandrewbailey wrote: post #24
rickdmer wrote: post #3

Hmm, that's pretty bad. CSS probably shouldn't be able to read password inputs. Edit: This doesn't seem to work for me in Chrome 63.0.3239.132 Edit 2: OK, so it appears that this will only work on a password input that updates its "value" attribute with the typed in value. This doesn't happen unless there is JavaScript that updates the value attr with the input.value

Is there even a use case where CSS needs to read any field's value? (Checkboxes and radio buttons have :checked.)

Something like conditional formatting maybe? Eg. make negative values red?

Make an input field red when it contains an invalid character?

Post reply on HN