News for hackers. Stuff that matters.

A comment on Timing attack against HSTS to sniff browser history in Chrome and Firefox. Parent comment

Re:Timing attack against HSTS to sniff browser history in Ch... by ejcx on Tuesday October 27, 2015 @01:39AM (#10456477)
AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1].

That's one of the reasons I like this talk so much. It really cemented these type of issue with real attacks, instead of a loosely described bunch of PoC. I remember reading somewhere on an RFC (perhaps CSP) that reporting can cause unwanted information leakage, but I didn't find it in the security considerations with a quick control+f just now.

[0] - https://lists.w3.org/Archives/Public/public-webappsec/2015Ju...

[1] - http://homakov.blogspot.com/2014/01/using-content-security-p...

[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Tuesday October 27, 2015 @02:11AM (#10456550)
In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for!

In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs

[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by ejcx on Tuesday October 27, 2015 @02:22AM (#10456580)
like you said, the security considerations are mostly theoretical. It actually might seem basic turning it into a real attack but it requires a fair bit of work.

It is always my favorite section of the RFCs. Along with anywhere that says "The UA [MUST|MAY|...] \w+". Much fun to be had....

[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by meowface on Tuesday October 27, 2015 @01:52AM (#10456500)
Ah, I feel silly now. I remember reading Egor's blog post on that last year.

Thanks.

[ Parent | on HN ]