Cross-site leaks: Difference between revisions

Cross-site leaks are a diverse form of attack, and there is no consistent classification of such attacks. Multiple sources classify cross-site leaks by the technique used to leak information. Among the well-known cross-site leaks are timing attacks, which depend on timing events within the web browser. Error events constitute another category, using the presence or absence of events to disclose data. Additionally, [[Cache timing attack|cache-timing attacks]] rely on the web cache to unveil information. Since 2023, newer attacks that use operating systems and web browser limits to leak information have also been found.

 

 

== Background ==

 

 

 

 

== Mechanism ==

Cross-site leak attacks part-2-phish.svg|An attacker identifies a vulnerable [[URL]] and [[Phishing|phishes]] the user to their website using an email. When the user goes to the attacker's website, the attacker can make malicious requests to the web server using the vulnerable URL.

Cross-site leak attacks part-3-exfil.svg|The attacker is prevented from reading the web server's response. However, other factors like the response time or size can be measured by the attacker, leaking information about the response – a [[side-channel attack]].

 

To circumvent this security barrier, the attacker can use browser-leak methods, to distinguish subtle differences between different responses. Browser leak methods are [[JavaScript]], [[CSS]] or [[HTML]] snippets that leverage long-standing [[information leakage]] issues ([[Side-channel attack|side channels]]) in the web browser to reveal specific characteristics about a HTTP response.{{sfn|Rautenstrauch|Pellegrino|Stock|2023|p=2747}}{{sfn|Van Goethem|Franken|Sanchez-Rola|Dworken|2022|p=787}} In the case of Gmail, the attacker could use JavaScript to time how long the browser took to [[Parsing|parse]] the HTTP response returned by the search result. If the time taken to parse the response returned by the endpoint was low, the attacker could infer that there were no search results for their query. Alternatively, if the site took longer, the attacker could infer that multiple search results were returned.{{sfn|Gelernter|Herzberg|2015|pp=1399–1402}} The attacker can subsequently use the information gained through these information leakages to exfiltrate sensitive information, which can be used to track and [[Data re-identification|deanonymize]] the victim.{{sfn|Sudhodanan|Khodayari|Caballero|2020|p=1}} In the case of Gmail, the attacker could make a request to the search endpoint with a query and subsequently measure the time the query took to figure out whether or not the user had any emails containing a specific query string.{{refn|group=note|An example of such a query could be the name of a well known bank, or the contact information of a person or organization that the user is expected to have interacted with.{{sfn|Gelernter|Herzberg|2015|p=1400}}}} If a response takes very little time to be processed, the attacker can assume that no search results were returned. Conversely, if a response takes a large amount amount of time to be processed, the attacker infer that a lot of search results were returned. By making multiple requests, an attacker could gain significant insight into the current state of the victim application, potentially revealing private information of a user, helping launch sophisticated spamming and phishing attacks.{{sfn|Gelernter|Herzberg|2015|p=1400}}

 

== History ==

 

 

 

== Threat model ==

The [[threat model]] of a cross-site leak relies on the attacker being able to direct the victim to a malicious website that is at least partially under the attacker's control. The attacker can accomplish this by compromising a web page, by phishing the user to a web page and loading arbitrary code, or by using a malicious advertisement on an otherwise-safe web page.{{sfn|Van Goethem|Franken|Sanchez-Rola|Dworken|2022|p=786}}{{sfn|Sudhodanan|Khodayari|Caballero|2020|p=11}}

While initially used only to differentiate between the time it took for a HTTP request to resolve a response,{{sfn|Bortz|Boneh|2007|pp=623–625}} research performed after 2007 has demonstrated the use of this leak technique to detect other differences across web-app states. In 2017, Vila et al. showed timing attacks could infer cross-origin execution times across embedded contexts. This was made possible by a lack of [[site isolation]] features in contemporaneous browsers, which allowed an attacking website to slow down and amplify timing differences caused by differences in the amount of JavaScript being executed when events were sent to a victim web app.{{sfn|Vila|Köpf|2017|pp=851–853}}{{sfn|Van Goethem|Franken|Sanchez-Rola|Dworken|2022|p=796}}

 

 

=== Error events ===

== Defences ==

 

 

Most modern defences are extensions to the HTTP protocol that either prevent state changes, make cross-origin requests [[Stateless protocol|stateless]], or completely isolate shared resources across multiple origins.{{sfn|Knittel|Mainka|Niemietz|Noß|2021|p=1780}}

* {{Cite book |last1=Van Goethem |first1=Tom |title=Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security |last2=Franken |first2=Gertjan |last3=Sanchez-Rola |first3=Iskander |last4=Dworken |first4=David |last5=Joosen |first5=Wouter |date=2022-05-30 |publisher=Association for Computing Machinery |isbn=978-1-4503-9140-5 |pages=784–798 |language=en |chapter=SoK: Exploring Current and Future Research Directions on XS-Leaks through an Extended Formal Model |doi=10.1145/3488932.3517416 |doi-access=free |s2cid=248990284}}{{Creative Commons text attribution notice|cc=by4|author(s)=Tom Van Goethem, Gertjan Franken, Iskander Sanchez-Rola, David Dworken and Wouter Joosen}}

* {{Cite book |last1=Van Goethem |first1=Tom |title=2023 IEEE Security and Privacy Workshops (SPW) |last2=Sanchez-Rola |first2=Iskander |last3=Joosen |first3=Wouter |date=2023 |publisher=IEEE |isbn=979-8-3503-1236-2 |pages=371–383 |language=en-US |chapter=Scripted Henchmen: Leveraging XS-Leaks for Cross-Site Vulnerability Detection |doi=10.1109/SPW59333.2023.00038 |access-date=2023-11-07 |chapter-url=https://ieeexplore.ieee.org/document/10188656 |s2cid=259267534 |s2cid-access=free}}

* {{Cite book |last1=Van Goethem |first1=Tom |last2=Joosen |first2=Wouter |last3=Nikiforakis |first3=Nick |chapter=The Clock is Still Ticking: Timing Attacks in the Modern Web |date=2015-10-12 |title=Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security |chapter-url=https://doi.org/10.1145/2810103.2813632 |series=CCS '15 |publisher=Association for Computing Machinery |pages=1382–1393 |doi=10.1145/2810103.2813632 |isbn=978-1-4503-3832-5|s2cid=17705638|s2cid-access=free }}

* {{Cite journal |last1=Vila |first1=Pepe |last2=Köpf |first2=Boris |date=2017 |title=Loophole: Timing Attacks on Shared Event Loops in Chrome |url=https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/vila |journal=SEC'17: Proceedings of the 26th USENIX Conference on Security Symposium |language=en |pages=849–864 |arxiv=1702.06764 |isbn=978-1-931971-40-9}}

* {{Cite book |last1=Zaheri |first1=Mojtaba |title=Security and Privacy in Communication Networks |last2=Curtmola |first2=Reza |date=2021 |publisher=Springer International Publishing |isbn=978-3-030-90022-9 |editor-last=Garcia-Alfaro |editor-first=Joaquin |series=Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering |volume=399 |pages=143–163 |language=en |chapter=Leakuidator: Leaky Resource Attacks and Countermeasures |doi=10.1007/978-3-030-90022-9_8|doi-access=free |editor2-last=Li |editor2-first=Shujun |editor3-last=Poovendran |editor3-first=Radha |editor4-last=Debar |editor4-first=Hervé |editor5-last=Yung |editor5-first=Moti |s2cid=237476137}}

* {{Cite journal |last1=Zaheri |first1=Mojtaba |last2=Oren |first2=Yossi |last3=Curtmola |first3=Reza |date=2022 |title=Targeted Deanonymization via the Cache Side Channel: Attacks and Defenses |url=https://www.usenix.org/conference/usenixsecurity22/presentation/zaheri |language=en |pages=1505–1523 |journal=Proceedings of the 31th USENIX Conference on Security Symposium |series=SEC '22 |isbn=978-1-939133-31-1 |s2cid=251092191 |s2cid-access=free}}

{{refend}}