Timing Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks

on YouTube ↗51m

" summary

Demonstrates practical extraction of secrets via timing side channels using browser-based XS-search (cache reloads of a single cached request) and second-order XS-search (planting inflated records), with demos that recover Gmail names from 2,000 options in ~42 seconds and extract 16-digit card numbers in ~50 seconds. Uses response inflation (up to ~400 kilobytes) and autocomplete leaks, repeats actions to create duplicates, and reports measured success rates around 96% success rate across hundreds of trials.

AI-written summary · about

" chapters (40)

1. 0:00Introduction
2. 1:18Title
3. 2:12Agenda
4. 2:32Background
5. 4:33Attacker Example
6. 5:44Advanced CrossSite Search Attacks
7. 6:11Basic CrossSite Search Attack Flow
8. 6:43Step 1 Challenge Search Request
9. 7:17Step 2 Dummy Search Request
10. 8:25Step 2 Challenge Search Request
11. 8:39Step 1 Statistical Tests
12. 9:32Challenges
13. 10:23Response Inflation
14. 11:49Attack on Gmail
15. 13:03Two new attack vectors
16. 13:39Browserbased timing attacks
17. 14:54Classical timing attacks
18. 17:05Algorithmic improvements
19. 17:59Evaluation
20. 18:36Example
21. 19:57Browserbased Optimization
22. 20:42Improved Accuracy
23. 20:54Demo
24. 22:09Limitations
25. 22:54Second Order Attack
26. 24:43Simple Attack
27. 25:32Simple Attack Flow
28. 26:55Inflating Second Order Attack
29. 27:38Extending the Model
30. 30:59How to create an inflating record
31. 31:51Extracting credit card numbers
32. 33:58Sending requests for autocomplete suggestions
33. 34:34Attacked account example
34. 36:15Attacked account demo
35. 39:19Attack success rate
36. 39:50Stealthy attack
37. 40:22Email services
38. 43:14Defenses
39. 44:06Conclusions
40. 44:36Questions

" related talks

• 30mAll in the timing: How side channel attacks workPhilip James, Asheesh Laroia · PyCon 2018
• 44mCache Me If You Can: Messing with Web CachingLouis Dion-Marcil · NorthSec 2019
• 34mFront-End Performance - The Dark SideMathias Bynens · ColdFront16
• 40mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · Øredev 2019
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 48mI Know Where You've Been: Geo-Inference Attacks Via The Browser CacheYaoqi Jia · Black Hat Asia 2015
• 33mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · RuhrJS 2019
• 50mHTTP Desync Attacks: Smashing into the Cell Next DoorJames Kettle · Black Hat USA 2019