4 ms·

Here's the paper: https://arxiv.org/pdf/2112.06324.pdf https://arxiv.org/pdf/2112.06324.pdf

akavel 5y ago
The tl;dr: “Pool-party” attacks work by manipulating pools of browser resources which are limited (i.e., the browser restricts how many of the resource websites can open or consume) and unpartitioned (i.e., different contexts consume resources from the same pool). While the examples focused on in this work utilize limited-but-unpartitioned pools of network connections, browsers include many other limited-but-unpartitioned resource pools that could be similarly exploited, such as pools of file handles, subprocesses, or other resource handles. A “pool-party” attack occurs when parties operating in distinct contexts (contexts the user expects to be distinct and blinded from each other) intentionally consume and query the availability of the limited resources in a resource pool, to create a cross-context communication channel. Each context can then use the communication channel to pass an identifier, allowing each party to link the users behavior across the two contexts. We note again that most commonly the two contexts considered here are two different websites running in the same browser profile, but could also be the same (or different) websites running in different browser profiles.
- formerly_proven 5y ago
  Uhm, cooperative cross-context channels are a dime a dozen just running on any CPU, nevermind in a browser. I don't see how this is interesting, or surprising. Modern computers are not MLS-style systems where it's supposed to be information-theoretically impossible to pass information unless permitted by a formal model.
  - infogulch 5y ago
    Is there no room for middle ground between "information theoretic formal proof" and "open the floodgates"? I don't run any MLS systems, so is my fate to just give up, drop my pants and take it?
    - formerly_proven 5y ago
      There is, you can for example use Qubes OS. That's pretty ergonomic and you get a reasonable amount of separation between stuff.

The tl;dr: “Pool-party” attacks work by manipulating pools of browser resources which are limited (i.e., the browser restricts how many of the resource websites can open or consume) and unpartitioned (i.e., different contexts consume resources from the same pool). While the examples focused on in this work utilize limited-but-unpartitioned pools of network connections, browsers include many other limited-but-unpartitioned resource pools that could be similarly exploited, such as pools of file handles, subprocesses, or other resource handles. A “pool-party” attack occurs when parties operating in distinct contexts (contexts the user expects to be distinct and blinded from each other) intentionally consume and query the availability of the limited resources in a resource pool, to create a cross-context communication channel. Each context can then use the communication channel to pass an identifier, allowing each party to link the users behavior across the two contexts. We note again that most commonly the two contexts considered here are two different websites running in the same browser profile, but could also be the same (or different) websites running in different browser profiles.

formerly_proven 5y ago
Uhm, cooperative cross-context channels are a dime a dozen just running on any CPU, nevermind in a browser. I don't see how this is interesting, or surprising. Modern computers are not MLS-style systems where it's supposed to be information-theoretically impossible to pass information unless permitted by a formal model.
- infogulch 5y ago
  Is there no room for middle ground between "information theoretic formal proof" and "open the floodgates"? I don't run any MLS systems, so is my fate to just give up, drop my pants and take it?
  - formerly_proven 5y ago
    There is, you can for example use Qubes OS. That's pretty ergonomic and you get a reasonable amount of separation between stuff.