3 ms·

No. Leaks were known far beyond the "supercookie", but attacks were not as high quality as these.

by ejcx 11y ago

meowface 11y ago
Could you link some older sources discussing some of these leaks? I'm having trouble finding any. Not doubting you, since you're probably right; would just be interested in reading them.
- ejcx 11y ago
  AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1]. That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that reporting can cause unwanted information leakage, but I didn't find it in the security considerations with a quick control+f just now. [0] - https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0030.html https://lists.w3.org/Archives/Public/public-webappsec/2015Ju... [1] - http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html http://homakov.blogspot.com/2014/01/using-content-security-p...
  - meowface 11y ago
    Ah, I feel silly now. I remember reading Egor's blog post on that last year. Thanks.
  - bcrypt 11y ago
    In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for! In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs https://www.youtube.com/watch?v=kk2GkZv6Wjs
    - ejcx 11y ago
      like you said, the security considerations are mostly theoretical. It actually might seem basic turning it into a real attack but it requires a fair bit of work. It is always my favorite section of the RFCs. Along with anywhere that says "The UA [MUST|MAY|...] \w+". Much fun to be had....
- bcrypt 11y ago
  [edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.] I may write a blog post later about this, but here are a few that come to mind (only counting things that have demos or have been observed in the wild): * css-visited browser history sniffing (fixed several years ago): http://dbaron.org/mozilla/visited-privacy http://dbaron.org/mozilla/visited-privacy * HSTS unique-subdomain combination supercookies: http://www.radicalresearch.co.uk/lab/hstssupercookies http://www.radicalresearch.co.uk/lab/hstssupercookies * lcamtuf's cache timing attack: http://lcamtuf.coredump.cx/cachetime/ http://lcamtuf.coredump.cx/cachetime/ * webrtc local ip leak: https://diafygi.github.io/webrtc-ips/ https://diafygi.github.io/webrtc-ips/ * panopticlick: https://panopticlick.eff.org/ https://panopticlick.eff.org/ * evercookie: http://samy.pl/evercookie http://samy.pl/evercookie

No. Leaks were known far beyond the "supercookie", but attacks were not as high quality as these.

by ejcx 11y ago

No. Leaks were known far beyond the "supercookie", but attacks were not as high quality as these.

Could you link some older sources discussing some of these leaks? I'm having trouble finding any. Not doubting you, since you're probably right; would just be interested in reading them.

ejcx 11y ago
AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1]. That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that reporting can cause unwanted information leakage, but I didn't find it in the security considerations with a quick control+f just now. [0] - https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0030.html https://lists.w3.org/Archives/Public/public-webappsec/2015Ju... [1] - http://homakov.blogspot.com/2014/01/using-content-security-policy-for-evil.html http://homakov.blogspot.com/2014/01/using-content-security-p...
- meowface 11y ago
  Ah, I feel silly now. I remember reading Egor's blog post on that last year. Thanks.
- bcrypt 11y ago
  In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for! In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs https://www.youtube.com/watch?v=kk2GkZv6Wjs
  - ejcx 11y ago
    like you said, the security considerations are mostly theoretical. It actually might seem basic turning it into a real attack but it requires a fair bit of work. It is always my favorite section of the RFCs. Along with anywhere that says "The UA [MUST|MAY|...] \w+". Much fun to be had....
bcrypt 11y ago
[edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.] I may write a blog post later about this, but here are a few that come to mind (only counting things that have demos or have been observed in the wild): * css-visited browser history sniffing (fixed several years ago): http://dbaron.org/mozilla/visited-privacy http://dbaron.org/mozilla/visited-privacy * HSTS unique-subdomain combination supercookies: http://www.radicalresearch.co.uk/lab/hstssupercookies http://www.radicalresearch.co.uk/lab/hstssupercookies * lcamtuf's cache timing attack: http://lcamtuf.coredump.cx/cachetime/ http://lcamtuf.coredump.cx/cachetime/ * webrtc local ip leak: https://diafygi.github.io/webrtc-ips/ https://diafygi.github.io/webrtc-ips/ * panopticlick: https://panopticlick.eff.org/ https://panopticlick.eff.org/ * evercookie: http://samy.pl/evercookie http://samy.pl/evercookie