News for hackers. Stuff that matters.

A comment on CSS @property and the New Style. Parent comment

Re:CSS @property and the New Style by mynameisvlad on Thursday September 05, 2024 @05:28AM (#41454981)
More than half of the examples you listed only partially use CSS as part of the exploit chain and could be done without CSS at all. For instance, you can certainly flash the screen but CSS is never going to be able to, on its own, read and exfiltrate the data necessary. You're relying on things like access logs at that point.
[ Parent | on HN ]
Re:CSS @property and the New Style by Jerrrrrrry on Thursday September 05, 2024 @06:40AM (#41455341) 

  CSS is never going to be able to, on its own, read and exfiltrate the data necessary.
CSS knows a lot, and it can send it back via image requests, triggered in states through animations, 'lazier'-loading, unqie font-choosing, etc.

https://blog.sheddow.xyz/css-timing-attack/

  You're relying on things like access logs at that point.
Well, yes. The timing and unique request path make identifying possible. And CSS can be dropped in context by other users, crafted to refer to a different domain, so CSS worms can definitely ex-filtrate data without the webmaster being evil.
[ Parent | on HN ]
Re:CSS @property and the New Style by ementally on Thursday September 05, 2024 @07:32AM (#41455569)
uBlock, I exfiltrate: exploiting ad blockers with CSS

https://portswigger.net/research/ublock-i-exfiltrate-exploit...

[ Parent | on HN ]