Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pixnapping Attack

pixnapping.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: Pixnapping Attack

#51

Post by shivasurya »

I would say this is a nice & clever attack vector by calculating from rendering time aka side channeling. Kudos to the researchers though it would take lot of time and capture pixels even for Google authenticator. My worry is now how much of this could be reproduced to steal OTP from messages.

Given to rise of well defined templates (accurately vibe coding design for example: GitHub notification emails) phishing via email, I have literally stopped clicking links email and now I have stop launching apps from intent directly (say open with). Better to open manually and perform such operation + remove useless apps but people underestimate the attack surface (it can come through sdk, web page intents)

Re: Pixnapping Attack

#52

Post by AJ007 »

4gotunameagain wrote: post #9

Modern devices are simply too complex to be completely secure. We have this tendency of adding more and more "features", more and more functionality 85% of which nobody asked for or has use for. I believe that there will be a market for a small, bare bones secure OS in the future. Akin to how freeBSD is being run.

From reading comments on hn over the past couple of years, I'm disappointed how terrible the security practices and knowledge has become. All of this stuff is about to get a lot worse with generative AI.

There are complaints on this story, and on the recent one about the fsf phone project about how inconvenient it is to not be able to access banking apps on your mobile phone. I can't be bothered to enter my banking password every 30 minutes on my desktop! What, I'm supposed to have two phones?

The first thing someone is going to do when they steal your phone (after they saw you enter your password in public) is open your banking and money apps and exfiltrate as much as they can from your accounts. This happens every single day. None of those apps should be installed or logged in on your phone. Same goes for 2FA apps. That's like traveling with Louis Vuitton luggage which is basically a "steal me" sign.

That's the most basic stuff for people who aren't a CEO of a company that is in the crosshairs of state sponsored espionage attacks.

The problems with "bare bones secure OS" device remain the same from a physical access standpoint: social engineering, someone sees your password, steals the device. But otherwise, yes, the devices you install a bunch of spyware/adware games on and take to bars should not be the ones you are doing your banking, 2FA, work, etc on ever.

Re: Pixnapping Attack

#53

Post by VGHN7XDuOXPAzol »

kingforaday wrote: post #31
TekMol wrote: post #26

My takeaway: Do not install apps. Use websites. Apps have way too much permissions, even when they have "no permissions".

I wish Uber or Lyft allowed me to use a website. I hate having to find a regular taxi or rely on the kindness of others to use their app.

surprisingly, Uber does! m.uber.com is a mobile website for Uber.

I only used once, in February, so hopefully they didn't break it since then.

Re: Pixnapping Attack

#54

Post by myfonj »

> I am an app developer. How do I protect my users? > We are not aware of mitigation strategies to protect apps against Pixnapping. If you have any insights into mitigations, please let us know and we will update this section.

IDK, I think there are obvious low-hanging attempts [0] such as: do not display secret codes in stable position on screen? Hide it when in background? Move it around to make timing attacks difficult? Change colours and contrast (over time)? Static noise around? Do not show it whole at the time (not necessarily so that user could observe it: just blink parts of it in and out maybe)? Admittedly, all of this will harm UX more or less, but in naïve theory should significantly raise demands for the attacker.

[0] Provided the target of the secret stealing is not in fact some system static raster snapshot containing the secret, cached for task switcher or something like that.

Re: Pixnapping Attack

#55

Post by macNchz »

pera wrote: post #39
TekMol wrote: post #26

My takeaway: Do not install apps. Use websites. Apps have way too much permissions, even when they have "no permissions".

I am not familiar to this type of side-channel attacks but the article says they use GPU.zip which is exploitable through Chrome: https://www.hertzbleed.com/gpu.zip/

Looks to me that the browser version requires the targeted website to be iframed into the malicious site for this to work, which is mitigated significantly by the fact that many sites today—and certainly the most security-sensitive ones—restrict where they can be iframed via security headers. Allowing your site to be loaded in an iframe elsewhere is already a security risk, and even the most basic scans will tell you you're vulnerable to clickjacking if you do not set those headers.

Re: Pixnapping Attack

#57

Post by chias »

myfonj wrote: post #54

> I am an app developer. How do I protect my users? > We are not aware of mitigation strategies to protect apps against Pixnapping. If you have any insights into mitigations, please let us know and we will update this section. IDK, I think there are obvious low-hanging attempts [0] such as: do not display secret codes in stable position on screen? Hide it when in background? Move it around to make timing attacks diff…

Huh. I remember a while ago Google Authenticator hid TOTP codes until you tap on them to reveal them. I remember thinking this was an absolutely stupid feature, because it did not mitigate any real threat and was annoying and inconvenient. Apparently a lot of people agreed because a few weeks later, Google Authenticator quietly rolled that feature back.

I wonder if they were aware of this flaw, and were mitigating the risk.

Re: Pixnapping Attack

#58

Post by x0x0 »

noname120 wrote: post #36

Note that for TOTP the attack is only feasible if the font and pixel-perfect positions on the screen are known: > The attacks described in Section 5 take hours to steal sensitive screen regions—placing certain categories of ephemeral secrets out of reach for the attacker app. Consider for example 2FA codes. By default, these 6-digit codes are refreshed every 30 seconds [38]. This imposes a strict time limit on the at…

Since there's only 3 or so (google, microsoft authenticator, okta, anyone else?) apps in widespread use, that seems not actually like an obstacle?

Re: Pixnapping Attack

#59

Post by goatsi »

x0x0 wrote: post #58
noname120 wrote: post #36

Note that for TOTP the attack is only feasible if the font and pixel-perfect positions on the screen are known: > The attacks described in Section 5 take hours to steal sensitive screen regions—placing certain categories of ephemeral secrets out of reach for the attacker app. Consider for example 2FA codes. By default, these 6-digit codes are refreshed every 30 seconds [38]. This imposes a strict time limit on the at…

Since there's only 3 or so (google, microsoft authenticator, okta, anyone else?) apps in widespread use, that seems not actually like an obstacle?

They also need to know where in the app the code for each service is displayed, so they are grabbing the code for your bank and not for your World of Warcraft account.

Re: Pixnapping Attack

#60

Post by x0x0 »

goatsi wrote: post #59
x0x0 wrote: post #58

Earlier quoted context omitted.

Since there's only 3 or so (google, microsoft authenticator, okta, anyone else?) apps in widespread use, that seems not actually like an obstacle?

They also need to know where in the app the code for each service is displayed, so they are grabbing the code for your bank and not for your World of Warcraft account.

which they can read from the same fixed layout/offsets displaying it to you
Post reply on HN