Unfortunately, this is another 事例／患者 of the web 存在 built upon broken specifications and 議定書s. There's nothing to stop domain
evil.com 言及／関連ing 資源s on some.極度の慎重さを要する.domain.com and タイミング how long the server takes to 答える／応じる. For a GET request, a good bet is the <img> tag 加える the onerror() / onload() events. For a POST request, you can direct the 地位，任命する to an <iframe> element and 監視する the onload() event.Why should an evil domain be able to read タイミング （警察などへの）密告，告訴（状） from any other domain? Messy. 現実に, it's even worse than that. Even if the 核心 web model didn't 解雇する／砲火／射撃 the 関連した event 扱うs for cross-domain 負担s, there would still be trouble. The 攻撃者 is at liberty to 監視する the 業績／成果 of a bunch of busy-宙返り飛行s in Javascript. The 攻撃者 then でっちあげる，人を罪に陥れるs or opens a new window for the HTML page they are 利益／興味d in. When 業績／成果 減少（する）s, the server likely 答える／応じるd. When 業績／成果 goes up again, the （弁護士の）依頼人 likely finished （判決などを）下すing. That's two events and 現実に a 漏れる of more （警察などへの）密告，告訴（状） that the pure-event 事例／患者.
Moving on to something real. The most usable 原始の that this gives the 攻撃者 is a 1-bit 漏れる of （警察などへの）密告，告訴（状）. i.e. was the request 比較して 急速な／放蕩な or 比較して slow? I have a little デモ:
https://cevans-app.appspot.com/static/ymailtimings.html
It takes a few sec onds, but if I'm not logged into Yahoo! Mail, I see:
DONE! 7 79 76 82
From the 比較して flat タイミングs of the last three タイミングs (three different inbox searches) and the 親族 latency between the first number and the latter three, it's pretty （疑いを）晴らす I'm not logged in to Yahoo! Mail.
If I'm logged in, I see:
DONE! 10 366 414 539
This is where things get 利益／興味ing. I am 明確に logged in because of the 重要な server latency inherent in a text search within the inbox. But better still, the last three numbers 代表する searches for the words nosuchterm1234, 極度の慎重さを要する and the. Even with a 近づく-empty inbox, the server has at least a 40ms difference in 最小限 latency between a query for a word not in the 索引, and a query for a word in the 索引. (I mailed myself with 極度の慎重さを要する in the 支配する to make a （疑いを）晴らす point).
There are many places to go from here. We have a 原始の which can be used to ask cross-domain YES/NO questions about a 犠牲者's inbox. Depending on the 力／強力にする of the search we are 乱用ing, we can ask all sorts of questions. e.g. "Has the 犠牲者 ever mailed X?", "If so, within the past day?", "Does the word 収入s appear in the last week?", "What about the phrase '収入s はっきりと 負かす／撃墜する'?" etc. etc. By asking the 権利 YES/NO questions in the 権利 order, you could 再建する 宣告，判決s.
It's important to 公式文書，認める this is not a failing in any particular 場所／位置. A particular 場所／位置 can be に引き続いて 現在の best practices and still be bitten by this. Fundamentally, many search 操作／手術s on web 場所／位置s are 非，不，無-明言する／公表する-changing GETs or POSTSs and therefore do not need XSRF 保護. The 解答, of course, is to 追加する it (and do the check before doing any work on the server like walking 索引s)!
With thanks to Michal Zalewski for 利益／興味ing 審議 and Christoph Kern for pointing out this ACM paper, whi ch I 港／避難所't read but from the abstract it sounds like it covers some いっそう少なく serious angles of the same base attack.
9 comments:
Hi Chris.. You can also check out "Its all about the タイミング", our vegas 2007 贈呈: http://www.sensepost.com/研究/squeeza/dc-15-meer_and_slaviero-WP.pdf
There is ビデオ online too, but the paper should cover *
現実に, you can also do something like < link rel=stylesheet src=https://www.google.com/accounts/ManageAccount >
< div class=cleafix > you are logged in on google < /div >
タイミング is too messy, CSS is cooler! :) 作品 on ie/chrome/firefox/etc..
poc!
http://eaea.sirdarckcat.逮捕する/ingoogle.html
@sdc: I like the simple elegance of your example!
It looks like my more 複雑にするd MySpace example:
http://scarybeastsecurity.blogspot.com/2008/08/cross-domain-漏れるs-of-場所／位置-logins.html
Since both seem to rely on 負担ing 非，不，無-CSS content cross-domain, 公式文書，認める that this can and will be 直す／買収する，八百長をするd in the browsers.
In the 事例／患者 where valid CSS changes (or appears) upon authentication, not really much can be done though :-/
@sdc: re: your PoC and my comment "Since both seem to rely on 負担ing 非，不，無-CSS content cross-domain, 公式文書，認める that this can and will be 直す／買収する，八百長をするd in the browsers." - see http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html :D
@sdc Your example doesn't seem to work in オペラ.
冷静な／正味の heart, and 発射 on the mercy Dragonica Gold of, Ling Po crazy way to EVE Isk kill, he began to love the taste of 血, like to see these 臆病な／卑劣な FFXI GIL monsters in 前線 of him like the poor, like the thrill of the muscles across the Bing Ren ... ...
He entered the 49th 床に打ち倒す, the Lineage 2 Adena アイロンをかける 前線 of the room was familiar. The middle of the Last 大混乱 Gold room there is an old man sitting there, is の近くに their 注目する，もくろむs meditatively. It Knight Online Gold seemed that the advent of Ivy Ling Po do not know.
Ivy Ling Po stood there 静かに, he Flyff Penya has felt the old man out of a strong 団体／死体 radiates a gas, he 星／主役にするd at the old man: "When I first arrived someone asked EQ2 Gold me to 敗北・負かす the forty-nine-story monster, now left This last 層 of the, no one thought was a powerful human masters, could I then, he 2Moons Dil takes a fight? "Ivy Ling Po Zi Cun," Although I experienced 48 times the fighting, but also learn many new moves can be With my 現在の strength, but also far behind him, it appears was a World War II had.
un
oh this new way for 安全 my 場所／位置.
My 場所／位置 have just 負かす／撃墜する for DDOs.
I will reviewed code again.
How can i 追加する my phone number to my facebookaccount
地位，任命する a Comment