bugtraq - fast and somewhat reliable cache timing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALx_OUB6QKv3z_Oojum4rVs8APJyTXQM-CTRGYZmayz3K+og1g@mail.gmail.com>
Date: Fri, 2 Dec 2011 16:21:53 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: bugtraq <bugtraq@...urityfocus.com>,
  full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: fast and somewhat reliable cache timing

Evening,

This party trick is not particularly exciting, but hopefully
highlights a vaguely interesting point:

http://lcamtuf.coredump.cx/cachetime/

In essence, in the past few years, browser vendors have severely
crippled CSS :visited selectors in order to prevent CSS-based history
snooping that made the headlines not long ago (see, for example,
http://wtikay.com).  Although it's fairly obvious that other privacy
side channels, such as cache timing, theoretically disclose comparable
data, the attacks demonstrated so far offered, at best, vaguely
probabilistic results (say,
http://www.cs.princeton.edu/sip/pub/webtiming.pdf). On top of that,
cache probing was considered destructive, which significantly limited
its usability.

Consequently, an argument was made that CSS :visited offered unique
performance and reliability benefits and needed to be addressed
separately, while no serious work takes place on the remaining
vectors.

My PoC exploits cache timing in Firefox in what appears to be a fairly
fast and reliable way. It is a crude hack, so it will probably fail
for some of you - but it's probably still interesting. The key point
is that to probe for cached content without immediately polluting the
cache, we abort navigation before the HTTP request is made. We also
work around setTimeout / setInterval clamps by leveraging event
delivery.

PS. If this is even remotely interesting, you may also enjoy
http://lcamtuf.coredump.cx/tangled/

Cheers,
/mz