Request and Conquer: Exposing Cross-Origin Resource Size
summary
Describes two concrete size‑leak techniques that recover exact cross‑origin resource lengths in seconds: a channel‑based evil twin man‑in‑the‑middle that clones a Wi‑Fi AP on another channel, blocks background packets, forwards only frames of specific lengths and subtracts protocol overhead to get payload size, and a browser side channel that exploits per‑origin cache quota abuse and the StorageManager getEstimate API to infer added bytes. Evaluated on 500,000 Twitter accounts by downloading five endpoints, yielding mostly unique size fingerprints; defenses: SameSite cookies and virtual padding in cache storage.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:28Motivating Example
- 6:31Travel Traffic Analysis
- 6:46Wi-Fi Traffic Analysis
- 10:20Side Channel Attack
- 11:42Per Side Quota Attack
- 15:46Cross-Site Search Attacks
- 19:18Disable Third-Party Cookies
- 20:57Virtual Padding
- 23:30How Did You Deal with Collisions
related talks
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
34mFront-End Performance - The Dark Side
50mHEIST: HTTP Encrypted Information can be Stolen Through TCP-Windows
48mHTTP Desync Attacks: Request Smuggling Reborn
25mWe Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS
51mTiming Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks
40mMisconfigured CORS and why web appsec is not getting easier
50mHTTP Desync Attacks: Smashing into the Cell Next Door