5 ms·

JavaScript Template Attacks

60 points by lainon 7y ago

hising 7y ago
Link to Github-repo in slides https://github.com/IAIK/jstemplate https://github.com/IAIK/jstemplate
lioeters 7y ago
Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version". Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."
- tantalor 7y ago
  > Why it's called... I still don't get it, very weird name. In JavaScript, "templates" are special strings that support interpolation: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
  - lioeters 7y ago
    I agree the name is a bit confusing, I also immediately thought of template literals, wondering what kind of vulnerability it could have.
  - kreetx 7y ago
    There's also a <template> html tag that one could relate the title to.
- thope 7y ago
  could be related to sidechannel template attack methodology: https://wiki.newae.com/Template_Attacks https://wiki.newae.com/Template_Attacks
  - tantalor 7y ago
    Yep it's actually mentioned somewhere in the paper: Chari et al. [10] introduced template attacks as a strong form of side-channel attacks. They first collect side-channel traces from an attacker-controlled device, the so-called template. Then, they collect a single trace from an identical device processing an unknown secret. The unknown secret can then be recovered by comparing the trace to the recorded templates.
mosdl 7y ago
I don't see whats new here - comparing global object values has always been used to identify browsers and versions. Same with looking for bugs/quirks in JS engines. New extension idea: adds random properties to window on each new page.
- antpls 7y ago
  I believe the new stuff is the exhaustive approach ("5796 different properties between Firefox and Chrome"), which is a bit scary actually.
  - mosdl 7y ago
    Recursively walking a tree is new?
XCSme 7y ago
I watched the video presentation, what's the take-away from it? Yes, different environments have different properties, but we knew this since the first browsers appeared. Is there anything new? This does not lead to an unique fingerprint. Is it more about the automated system that detects the properties that change or just bringing awarness of the issue?

60 points by lainon 7y ago

Link to Github-repo in slides https://github.com/IAIK/jstemplate https://github.com/IAIK/jstemplate

Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version". Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."

tantalor 7y ago
> Why it's called... I still don't get it, very weird name. In JavaScript, "templates" are special strings that support interpolation: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- lioeters 7y ago
  I agree the name is a bit confusing, I also immediately thought of template literals, wondering what kind of vulnerability it could have.
- kreetx 7y ago
  There's also a <template> html tag that one could relate the title to.
thope 7y ago
could be related to sidechannel template attack methodology: https://wiki.newae.com/Template_Attacks https://wiki.newae.com/Template_Attacks
- tantalor 7y ago
  Yep it's actually mentioned somewhere in the paper: Chari et al. [10] introduced template attacks as a strong form of side-channel attacks. They first collect side-channel traces from an attacker-controlled device, the so-called template. Then, they collect a single trace from an identical device processing an unknown secret. The unknown secret can then be recovered by comparing the trace to the recorded templates.

mosdl 7y ago

I don't see whats new here - comparing global object values has always been used to identify browsers and versions. Same with looking for bugs/quirks in JS engines. New extension idea: adds random properties to window on each new page.

antpls 7y ago
I believe the new stuff is the exhaustive approach ("5796 different properties between Firefox and Chrome"), which is a bit scary actually.
- mosdl 7y ago
  Recursively walking a tree is new?

XCSme 7y ago

I watched the video presentation, what's the take-away from it? Yes, different environments have different properties, but we knew this since the first browsers appeared. Is there anything new? This does not lead to an unique fingerprint. Is it more about the automated system that detects the properties that change or just bringing awarness of the issue?