3 ms·
They're setting custom fonts, but specifying the fonts should only be used for particular characters. This attack assumes the attacker has some way of getting
by ZoFreX 11y ago
They're setting custom fonts, but specifying the fonts should only be used for particular characters.
This attack assumes the attacker has some way of getting CSS they wrote onto the target website, via some other exploit.
The attacker then hosts many font files on a webserver they control. Let's call the fonts "a", "b", "c", and so on.
They then inject the CSS to set the font for text on the target page to their custom fonts - but tell it "use font a for all of the 'a' characters" and so on.
By observing which fonts are downloaded from their webserver, they can learn information on which characters are and are not present on the page.
- deanclatworthy 11y agoOkay, I understand now. Thanks.
- tptacek 11y agoIf it's helpful: the "sting" of this attack is that it works even when you can't inject Javascript into the page; that's why it's referred to as an "HTML injection attack". The canonical HTML injection attack is cross-site scripting --- it's so canonical, in fact, that we usually just think about XSS, and not the generalized flaw of HTML injection. This is an illustration of how even closing off Javascript as an attack vector doesn't stop HTML injection attacks from working. See also: http://lcamtuf.coredump.cx/postxss/ http://lcamtuf.coredump.cx/postxss/
- MichaelGG 11y agoIf you get HTML/CSS control isn't that game over? If I can get HTML loaded into your Gmail tab, then I can setup a fake login or "Please re-enter your password to continue" that has a form action of myserver. (Which then just redirects you to wherever you were.) Injecting scripting is cute because it's far more flexible, but I'd guess an HTML injection is enough to get a fairly high rate of success, albeit a bit more noticeably.