Browser history re :visited Michael Smith Craig Disselkoen Shravan - - PowerPoint PPT Presentation

▶
browser history re visited
SMART_READER_LITE
LIVE PREVIEW

Browser history re :visited Michael Smith Craig Disselkoen Shravan - - PowerPoint PPT Presentation

Apr 27, 2023 133 likes •1.49k views

Browser history re :visited Michael Smith Craig Disselkoen Shravan Narayan Fraser Brown * Deian Stefan UC San Diego * Stanford University Web Content Web Content sandboxing Web Content history history history data data

slide-1
SLIDE 1

Browser history re:visited

Michael Smith† Craig Disselkoen† Shravan Narayan† Fraser Brown* Deian Stefan†

†UC San Diego *Stanford University
slide-2
SLIDE 2
slide-3
SLIDE 3

Web Content

slide-4
SLIDE 4

Web Content

sandboxing

slide-5
SLIDE 5

Web Content

sandboxing

history data history data history data

slide-6
SLIDE 6

history data history data history data

  • https://www.google.com
  • https://www.google.com/search?q=usenix+woot+2018
  • https://bulkcheesewhizdelivery.com
  • https://ashleymadison.com
slide-7
SLIDE 7

history data history data history data

Click here

“This points to something new!”

  • https://www.google.com
  • https://www.google.com/search?q=usenix+woot+2018
  • https://bulkcheesewhizdelivery.com
  • https://ashleymadison.com
slide-8
SLIDE 8

Click here

history data history data history data “I’ve been there before!”

  • https://www.google.com
  • https://www.google.com/search?q=usenix+woot+2018
  • https://bulkcheesewhizdelivery.com
  • https://ashleymadison.com
slide-9
SLIDE 9

2002

slide-10
SLIDE 10

https://www.usenix.org/conference/woot18

slide-11
SLIDE 11

https://www.usenix.org/conference/woot18

|Click here|

slide-12
SLIDE 12

https://www.usenix.org/conference/woot18

|Click here| visited = true

slide-13
SLIDE 13

https://www.usenix.org/conference/woot18

|Click here| visited = false

slide-14
SLIDE 14

Source: Alexa Top Sites

slide-15
SLIDE 15

bandwidth = URLs / second

Source: Alexa Top Sites

slide-16
SLIDE 16

2002 - initial disclosure

slide-17
SLIDE 17

2002 - initial disclosure 2010 - ~3,000 URLs/sec

slide-18
SLIDE 18

2002 - initial disclosure 2010 - ~3,000 URLs/sec

slide-19
SLIDE 19

2002 - initial disclosure 2010 - ~3,000 URLs/sec 2011 - MozAfterPaint leak (~100 URLs/sec) 2013 - ‘Pixel Perfect’ attack (~60 URLs/sec)

slide-20
SLIDE 20

2002 - initial disclosure 2010 - ~3,000 URLs/sec 2011 - MozAfterPaint leak (~100 URLs/sec) 2013 - ‘Pixel Perfect’ attack (~60 URLs/sec) 2018 (CR deadline) - CVE-2018-6137 (~3,000)

slide-21
SLIDE 21

2002 - initial disclosure 2010 - ~3,000 URLs/sec 2011 - MozAfterPaint leak (~100 URLs/sec) 2013 - ‘Pixel Perfect’ attack (~60 URLs/sec) 2018 (CR deadline) - CVE-2018-6137 (~3,000) 2018 (talk) - ~6,000 URLs/sec

slide-22
SLIDE 22

2002 - initial disclosure 2010 - ~3,000 URLs/sec 2011 - MozAfterPaint leak (~100 URLs/sec) 2013 - ‘Pixel Perfect’ attack (~60 URLs/sec) 2018 (CR deadline) - CVE-2018-6137 (~3,000) 2018 (talk) - ~6,000 URLs/sec

slide-23
SLIDE 23

4 APIs, 4 attacks

  • CSS Paint API
  • CSS 3D transforms
  • SVG fill-coloring
  • JavaScript bytecode cache
slide-24
SLIDE 24

Security-focused browsers affected Chrome + Site Isolation Chrome + ChromeZero add-on DeterFox FuzzyFox Brave Tor Browser Unaffected

slide-25
SLIDE 25

historySniffer() input: target URLs

  • utput: visited URLs
slide-26
SLIDE 26

TODO ☐ find vulnerable feature ☐ leak visited bit for a URL ☐ exfiltrate visited bit ☐ amplify bandwidth

slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38
slide-39
SLIDE 39

index.html

slide-40
SLIDE 40

index.html

slide-41
SLIDE 41

index.html

slide-42
SLIDE 42

index.html

slide-43
SLIDE 43

index.html

slide-44
SLIDE 44

paintlet.js

slide-45
SLIDE 45

index.html

slide-46
SLIDE 46

index.html

slide-47
SLIDE 47
slide-48
SLIDE 48

paintlet.js

slide-49
SLIDE 49

paintlet.js

*invalidation* *invalidation* *invalidation* *invalidation* *invalidation*

slide-50
SLIDE 50

paintlet.js

*invalidation* *invalidation* *invalidation* *invalidation* *invalidation*

slide-51
SLIDE 51

paintlet.js

*invalidation* *invalidation* *invalidation* *invalidation* *invalidation*

slide-52
SLIDE 52

paintlet.js

slide-53
SLIDE 53

paintlet.js

slide-54
SLIDE 54

paintlet.js

slide-55
SLIDE 55
slide-56
SLIDE 56

Click here

slide-57
SLIDE 57

TODO ☑ find vulnerable feature ☐ leak visited bit for a URL ☐ exfiltrate visited bit ☐ amplify bandwidth

slide-58
SLIDE 58

...unvisited If https://ashleymadison.com is... ...visited

slide-59
SLIDE 59

Attacker creates link pointing to https://dummy.com; visited = false

If https://ashleymadison.com is... ...unvisited

slide-60
SLIDE 60

Attacker creates link pointing to https://dummy.com; visited = false

If https://ashleymadison.com is... ...unvisited

slide-61
SLIDE 61

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link

If https://ashleymadison.com is... ...unvisited

slide-62
SLIDE 62

Attacker creates link pointing to https://dummy.com; visited = false

Click here

Browser does initial paint of link

If https://ashleymadison.com is... ...unvisited

slide-63
SLIDE 63

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited

Click here

slide-64
SLIDE 64

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited

Click here

slide-65
SLIDE 65

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Attacker updates link to point to https://ashleymadison.com; visited remains false Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited

Click here

slide-66
SLIDE 66

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Attacker updates link to point to https://ashleymadison.com; visited remains false Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited

Click here

slide-67
SLIDE 67

If https://ashleymadison.com is... ...visited

slide-68
SLIDE 68

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false

slide-69
SLIDE 69

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false

slide-70
SLIDE 70

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link

slide-71
SLIDE 71

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link

Click here

slide-72
SLIDE 72

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method

Click here

slide-73
SLIDE 73

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method

Click here

slide-74
SLIDE 74

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link

Click here

*invalidation* *invalidation* *invalidation* *invalidation* *invalidation*

slide-75
SLIDE 75

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link

Click here

*invalidation* *invalidation* *invalidation* *invalidation* *invalidation*

Browser re-paints link

slide-76
SLIDE 76

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link Browser re-paints link

Click here

slide-77
SLIDE 77

If https://ashleymadison.com is... ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link Browser re-paints link Browser calls paintlet’s paint method

Click here

slide-78
SLIDE 78

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Attacker updates link to point to https://ashleymadison.com; visited remains false Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link Browser re-paints link Browser calls paintlet’s paint method

slide-79
SLIDE 79

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Attacker updates link to point to https://ashleymadison.com; visited remains false Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link Browser re-paints link Browser calls paintlet’s paint method

slide-80
SLIDE 80

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Attacker updates link to point to https://ashleymadison.com; visited remains false Browser calls paintlet’s paint method

If https://ashleymadison.com is... ...unvisited ...visited

Attacker creates link pointing to https://dummy.com; visited = false Browser does initial paint of link Browser calls paintlet’s paint method Attacker updates link to point to https://ashleymadison.com; visited becomes true, invalidates link Browser re-paints link Browser calls paintlet’s paint method

slide-81
SLIDE 81

TODO ☑ find vulnerable feature ☑ leak visited bit for a URL ☐ exfiltrate visited bit ☐ amplify bandwidth

slide-82
SLIDE 82

Paintlets can’t communicate

slide-83
SLIDE 83

Paintlets can’t communicate

paintlet.js paint()

slide-84
SLIDE 84

Paintlets can’t communicate

paintlet.js paint()

slide-85
SLIDE 85

paintlet.js paint()

Paintlets can’t communicate

slide-86
SLIDE 86

✘ ✘

paintlet.js paint()

Paintlets can’t communicate

slide-87
SLIDE 87

✘ ✘

main.js

✘

paintlet.js paint()

Paintlets can’t communicate

slide-88
SLIDE 88

✘ ✘

main.js

✘ ✘ ✘

paintlet.js paint()

Paintlets can’t communicate

slide-89
SLIDE 89

main.js paintlet.js paint()

slide-90
SLIDE 90

main.js paintlet.js paint()

slide-91
SLIDE 91

main.js paintlet.js paint()

slide-92
SLIDE 92

main.js paintlet.js paint()

slide-93
SLIDE 93

TODO ☑ find vulnerable feature ☑ leak visited bit for a URL ☑ exfiltrate visited bit ☐ amplify bandwidth

slide-94
SLIDE 94

Timing attacks are slow :(

slide-95
SLIDE 95

Click here

[max bandwidth: 60 URLs/sec]

Timing attacks are slow :(

slide-96
SLIDE 96

Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here

Timing attacks are slow :(

slide-97
SLIDE 97

Other covert channels are fast :) Timing attacks are slow :(

slide-98
SLIDE 98

registerPaint() covert channel

Other covert channels are fast :) Timing attacks are slow :(

slide-99
SLIDE 99

registerPaint() covert channel

  • registerPaint() function can be called

inside paintlet sandbox

  • Unintended behavior: can use

registerPaint() to control width of element outside paintlet sandbox

slide-100
SLIDE 100

registerPaint() covert channel

1) create weird HTML element outside paintlet

slide-101
SLIDE 101

registerPaint() covert channel

2) call registerPaint() inside paintlet

slide-102
SLIDE 102

registerPaint() covert channel

3) weird element gets big width value width = 154 pixels

slide-103
SLIDE 103

registerPaint() covert channel

3) weird element gets big width value width = 154 pixels width = 4 pixels vs

slide-104
SLIDE 104

registerPaint() covert channel

visited

slide-105
SLIDE 105

registerPaint() covert channel

visited

call registerPaint()

paintlet.js

slide-106
SLIDE 106

registerPaint() covert channel

visited

call registerPaint()

paintlet.js web page

slide-107
SLIDE 107

registerPaint() covert channel

visited

call registerPaint()

unvisited

paintlet.js web page

slide-108
SLIDE 108

registerPaint() covert channel

visited

call registerPaint()

unvisited

DON’T call registerPaint()

paintlet.js web page

slide-109
SLIDE 109

registerPaint() covert channel

visited

call registerPaint()

unvisited

DON’T call registerPaint()

paintlet.js web page

slide-110
SLIDE 110

registerPaint() covert channel

visited unvisited

getBoundingClientRect() .width == 154 getBoundingClientRect() .width == 4

web page main.js

slide-111
SLIDE 111

Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here Click here

registerPaint() covert channel

slide-112
SLIDE 112

Demo!

slide-113
SLIDE 113

TODO ☑ find vulnerable feature ☑ leak visited bit for a URL ☑ exfiltrate visited bit ☑ amplify bandwidth

slide-114
SLIDE 114

4 APIs, 4 attacks

  • CSS Paint API
  • CSS 3D transforms
  • SVG fill-coloring
  • JavaScript bytecode cache
slide-115
SLIDE 115

Attack: CSS 3D transforms

unvisited visited

Attacker rapidly toggles the link’s destination between a dummy URL and a target URL Browser doesn’t need to re-render the link → paint performance is FAST Attacker makes a link expensive to render with CSS 3D transforms Browser does lots of expensive re-renders for the link → paint performance is SLOW

slide-116
SLIDE 116

Attack: SVG fill-coloring

unvisited visited

Attacker rapidly toggles the link’s destination between a dummy URL and a target URL Browser doesn’t need to re-render the link → paint performance is FAST Attacker puts a complex SVG image inside a link Browser does lots of expensive re-renders for the link → paint performance is SLOW

Attacker sets fill-styles to change SVG image’s colors if link is visited

slide-117
SLIDE 117

Attack: JavaScript bytecode cache

unvisited visited

Browser has to compile script from scratch → compilation time is LONG Attacker injects script from target site into their own page Browser has script’s bytecode in cache, skips most of compilation → compilation time is SHORT Attacker measures script’s compilation time

slide-118
SLIDE 118

4 APIs, 4 attacks

  • CSS Paint API
  • CSS 3D transforms
  • SVG fill-coloring
  • JavaScript bytecode cache
slide-119
SLIDE 119

2002 - initial disclosure 2010 - ~3,000 URLs/sec

slide-120
SLIDE 120

“Our survey shows that several popular sites, including Alexa global top-100 sites, use privacy-violating flows to exfiltrate information about users’ browsing behavior.”

slide-121
SLIDE 121

SaaS = Sniffing as a Service

“Track which sites your visitors

  • visit. Learn how many of them have

been to your competitor's site or your advertising partner's site.” “Tealium's patent-pending technology lets you see the view-through traffic to your site by those who’ve been exposed to your press, or blog or video coverage.”

slide-122
SLIDE 122

Defense: “referrer-origin labels”

Click here

https://a.com

slide-123
SLIDE 123

Defense: “referrer-origin labels”

Click here

https://a.com https://b.com

slide-124
SLIDE 124

Defense: “referrer-origin labels”

Click here

https://a.com https://b.com

History

slide-125
SLIDE 125

Defense: “referrer-origin labels”

Click here

https://a.com https://b.com a.com

History

slide-126
SLIDE 126

Defense: “referrer-origin labels”

Click here

https://a.com https://b.com a.com

Click here

https://c.com

History

slide-127
SLIDE 127

Defense: “referrer-origin labels”

Click here

https://a.com https://b.com a.com

Click here

https://c.com https://b.com c.com

History

slide-128
SLIDE 128

“Is https://b.com visited?”

renderer IPC layer storage engine

https://b.com a.com

web content

Click here

https://c.com

slide-129
SLIDE 129

“Is https://b.com visited?”

storage engine

https://b.com a.com

renderer IPC layer web content

Click here

https://c.com

slide-130
SLIDE 130

“Is https://b.com visited?”

storage engine

https://b.com a.com

renderer IPC layer web content

Click here

https://c.com

slide-131
SLIDE 131

“Is https://b.com visited?”

storage engine

https://b.com a.com

renderer IPC layer

c.com c.com c . c

  • m

web content

Click here

https://c.com

slide-132
SLIDE 132

Defense: “referrer-origin labels”

1) Applies to: history data + cache data

slide-133
SLIDE 133

2) Replaces prior mitigations

slide-134
SLIDE 134
  • Attack: invisibly determine whether exact

URLs are visited ○ 4 APIs, 4 attacks ○ Major browsers affected ○ CVE-2018-6137:

  • ur highest bandwidth (~6,000 URLs/sec)
  • Defense: “referrer-origin labels”