All Your Queries Are Belong to Us: The Power of File-Injection Attacks...
summary
Shows concrete file-injection attacks that recover encrypted search queries by sending crafted documents and observing which injected files appear in results. A binary search attack uniquely identifies a keyword with logarithmic injections (about 14 files for 10,000 keywords); an advanced adaptive variant succeeds with ~30% accuracy when the server knows 1% of files and reaches near 100% as leakage grows using only 9 injected files (or ≤40 when targeting many tokens) under a threshold of 200 keywords. Attacks exploit no forward privacy and survive common padding countermeasures.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:27Agenda
- 0:43Email system
- 1:26What is Searchable Encryption?
- 2:13Applications
- 2:57Leakage of Searchable Encryption
- 5:26Prior Attacks on Searchable Encryption
- 6:07Main Contributions
- 6:56Attack Target: Query Recovery Attacks
- 7:58Attack Model: File-injection Attack
- 12:17Limitation
- 12:32Threshold Countermeasure
- 14:11Attacks with Partial File Leakage
- 14:40Attacks to Recover 1 Token
- 15:52Difference from Binary Search Attack
- 17:26Attacks to Recover Multiple Tokens
- 17:42Experimental Methodology
- 18:09Experimental Results: Recover 1 Query
- 19:55Insights
- 20:37Conjunctive SE
- 21:53Search Result Padding: Experiments
- 23:15Other Countermeasures
- 25:00Conclusions
related talks
25mOver 20 Years of SQL Injection Attacks in the Wild - Time to Refine and ...
51mTiming Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks
33mSecuring Retrieval-Augmented Generation
54mTaking on the King: Killing Injection Vulnerabilities
57mSomething Something Security
38mInjections - 4 Ways of Penetration
22mSecure Your Code — Injections and Logging
41mSecurity Vulnerabilities Decomposition: Another Way To Look At Vulnerabilities