JavaScript Template Attacks

https://www.ndss-symposium.org/ndss-paper/javascript-template-attacks-automatically-inferring-host-information-for-targeted-exploits/

by lainon • 7 years ago

60 11 7 years ago

ndss-symposium.org

hising• 7 years ago

Link to Github-repo in slides https://github.com/IAIK/jstemplate

lioeters2• 7 years ago

Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version".

Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."

tantalor2• 7 years ago

Why it's called...

I still don't get it, very weird name.

In JavaScript, "templates" are special strings that support interpolation: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

lioeters2• 7 years ago

I agree the name is a bit confusing, I also immediately thought of template literals, wondering what kind of vulnerability it could have.

kreetx• 7 years ago

There's also a <template> html tag that one could relate the title to.

thope• 7 years ago

could be related to sidechannel template attack methodology:

https://wiki.newae.com/Template_Attacks

tantalor2• 7 years ago

Yep it's actually mentioned somewhere in the paper:

Chari et al. [10] introduced template attacks as a strong form of side-channel attacks. They first collect side-channel traces from an attacker-controlled device, the so-called template. Then, they collect a single trace from an identical device processing an unknown secret. The unknown secret can then be recovered by comparing the trace to the recorded templates.

mosdl2• 7 years ago

I don't see whats new here - comparing global object values has always been used to identify browsers and versions. Same with looking for bugs/quirks in JS engines.

New extension idea: adds random properties to window on each new page.

antpls• 7 years ago

I believe the new stuff is the exhaustive approach ("5796 different properties between Firefox and Chrome"), which is a bit scary actually.

mosdl2• 7 years ago

Recursively walking a tree is new?

XCSme• 7 years ago

I watched the video presentation, what's the take-away from it? Yes, different environments have different properties, but we knew this since the first browsers appeared. Is there anything new? This does not lead to an unique fingerprint. Is it more about the automated system that detects the properties that change or just bringing awarness of the issue?

JavaScript Template Attacks

Related Stories