4 ms·
The thing is: this attack doesn't even use CORS. It just sends a GET request to an URL and looks at the timing, which can be done using the fetch/Resource Timin
by pfg 10y ago
The thing is: this attack doesn't even use CORS. It just sends a GET request to an URL and looks at the timing, which can be done using the fetch/Resource Timing APIs.
Here's a JSFiddle to play around with this[1], based on the code in the paper, using GitHub's account page as an example. You'll notice that the request succeeds and the fiddle has access to timing information. Inspecting the requests will show that there are no CORS headers being sent (like Origin) based on which the target could prevent the request from being served. (There's the Referer header, I suppose, but blocking the request based on that would break pretty much any third-party link to that page.)
I've tested this against various high-profile sites that include sensitive information (Google's account page, Twitter's account page, etc.), and it worked just fine on each of them. Most of them also have a parameter reflection vector (typically the full request URL is included somewhere on the page, which should be enough), so I'm pretty sure each of those sites are potentially vulnerable (though I'm not sure if calling a site vulnerable is the right approach here).
[1]: https://jsfiddle.net/39rsn2kg/ https://jsfiddle.net/39rsn2kg/
- nine_k 10y agoWould inclusion of a small random timeout before serving the request solve this? Would not the load balancer activity cancel the effect? If anything, adding random garbage to the error page to approximately match the size of a normal response should make the attack useless.
- pfg 10y agoTypical (WAN) network conditions are not all that different from a small random timeout, and these kind of attacks still work. Adding random noise just means you'll need more samples, but statistics are going to win eventually. I guess a combination of random noise and tight request rate limiting might mitigate this in practice (in exchange for a DoS vector, I suppose).
- turbohedgehog 10y agoWhat will break if the fetch/timing APIs are turned off in the browser?
- pfg 10y agoThe Resource Timing APIs are typically used for performance monitoring. I expect well-behaved sites would degrade gracefully if those APIs aren't available (because they're not universally available anyway - Safari, for example, doesn't seem to have implemented them at all).