Why not input[type="password"] { background-image: url(attr(value)); } ?
url(attr(...)) isn't supported by any browser yet, AFAIK
Show HN: A CSS Keylogger
81–90 of 173 posts
Re: Show HN: A CSS Keylogger
#82Can't Chrome extensions already intercept network traffic though? Why does this need to be done at the CSS level?
Chrome extensions are used here as the method for injecting CSS, but there are other possible ways to inject such CSS.
e.g. ads.
Re: Show HN: A CSS Keylogger
#83Can't Chrome extensions already intercept network traffic though? Why does this need to be done at the CSS level?
This is a very good question. The github project README does not say anything about the issue with the extensions. Does it also work in a regular page? Weird.
Re: Show HN: A CSS Keylogger
#84CSS has gone too far. At least when I'm worried about a nasty javascript attack from a site I can be somewhat reassured that noscript/umatrix will work. Am I going to have to start whitelisting CSS now too? Am I too late?
As other comments have stated, this only works if the 'value' attr is being set on the input box as you type (which React will do), so it still requires JS.
There are a lot of sites where you wouldn't need to inject the JS code for react though.
Re: Show HN: A CSS Keylogger
#85Earlier quoted context omitted.
Assuming the server receives the requests in the same order as the requests were sent, which on mobile networks isn't anywhere near so certain.
Not an efficient keylogger, however, if you know the pressed keys, you can just generate permutations ordered using probabilities, and that would be a lot faster than brute force. The real deal here is, it depends on some js code updating the dom for each key press, which is BAAAD. Not an useless keylogger, because it reminds a vulnerability product of choosing a bad decision.
> it depends on some js code updating the dom for each key press
Like React with JSX?
Re: Show HN: A CSS Keylogger
#86Earlier quoted context omitted.
> The Instagram password field mentioned in the readme.md DOES work this way due to some custom javascript, for reasons that escape me Instagram is a React app and React works that way.
React doesn't work that way. It's a convention which I persoally have always found questionable.
It's more than a convention. It's presented as the default way to do it in the official docs. https://reactjs.org/docs/forms.html#controlled-components
Re: Show HN: A CSS Keylogger
#87I've been noticing a lot of CSP talk lately, how CSP is the end-all be-all solution for lots of these types of attacks. Makes me think we should have more articles about how to properly implement a CSP!
(content security policy-prevents requests to websites not on the white-list -- the background image request would be rejected)
Re: Show HN: A CSS Keylogger
#88Couldn't Content Security Policy (CSP) [1] be used to mitigate this attack? [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
It actually can't. Instagram does use this protect java-script injection from extensions, but clearly injecting CSS is allowed.
Re: Show HN: A CSS Keylogger
#89Earlier quoted context omitted.
If you use React, updating the value on every change is a very common pattern.
This is speculative as I haven't tested out this vulnerability or attempted to avoid it (yet), but I imagine this means it would be a good idea to make password fields "uncontrolled"[1] if you're using react. 1: https://reactjs.org/docs/uncontrolled-components.html
That seems reasonable.
The apps I've worked on weren't full SPAs, so I just used plain HTML for the login form.
Re: Show HN: A CSS Keylogger
#90Earlier quoted context omitted.
Your background-image url must be an endpoint that can process a request. Simply, requesting a placehold.it/a image is pointless, but sending to l33thacker.com/a, assuming that l33thacker.com knows how to process that request maliciously, will work.
But you would still see the network call to placehold.it/ if it actually worked.
It can be done manually. Send the request to a server you control and check the logs. It doesn't scale well but it would work fine for a targeted attack.