nach oben

Erschienen in:

2020 | OriginalPaper | Buchkapitel

Cross-Site Search Attacks: Unauthorized Queries over Private Data

verfasst von : Bar Meyuhas, Nethanel Gelernter, Amir Herzberg

Erschienen in: Cryptology and Network Security

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

Cross-site search attacks allow a rogue website to expose private, sensitive user-information from web applications. The attacker exploits timing and other side channels to extract the information, using cleverly-designed cross-site queries.

In this work, we present a systematic approach to the study of cross-site search attacks. We begin with a comprehensive taxonomy, clarifying the relationships between different types of cross-site search attacks, as well as relationships to other attacks. We then present, analyze, and compare cross-site search attacks; We present new attacks that have improved efficiency and can circumvent browser defenses, and compare to already-published attacks. We developed and present a reproducibility framework, which allows study and evaluation of different cross-site attacks and defenses.

We also discuss defenses against cross-site search attacks, for both browsers and servers. We argue that server-based defenses are essential, including restricting cross-site search requests.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Energy Analysis of Lightweight AEAD Circuits

Nächstes Kapitel Stronger Targeted Poisoning Attacks Against Malware Detection

Barth, A., Jackson, C., Mitchell, J.C.: Robust defenses for cross-site request forgery. In: Proceedings of the Conference on Computer and Communications Security (2008)

Bortz, A., Boneh, D.: Exposing private information by timing web applications. In: Proceedings of the 16th International Conference on World Wide Web, pp. 621–628. ACM (2007)

Managing Storage. https://developer.chrome.com/apps/offline_storage#managing_quota

Issue 617963: Security: Service workers response size info leak. https://bugs.chromium.org/p/chromium/issues/detail?id=617963

Issue - Chromium. https://bugs.chromium.org/p/chromium/issues/detail?id=1013906

Changes to cross-origin requests in chrome extension content scripts. https://www.chromium.org/Home/chromium-security/extension-content-script-fetches

Cross-origin read blocking for web developers. https://www.chromium.org/Home/chromium-security/corb-for-developers

Cross-Origin Read Blocking (CORB). https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md

DETERLab Capabilities. https://deter-project.org/deterlab_capabilities

10.

Enron Email Dataset, May 2015. https://www.cs.cmu.edu/~enron/

11.

Enron email frontend archive, October 2017. https://github.com/antiboredom/enron-email-archive

12.

Fetch API standards. https://fetch.spec.whatwg.org/#concept-request-credentials-mode

13.

Gelernter, N., Herzberg, A.: Cross-site search attacks. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 1394–1405. ACM (2015)

14.

Gelernter, N., Herzberg, A.: Tell me about yourself: the malicious captcha attack. In: Proceedings of the 25th International Conference on World Wide Web, pp. 999–1008. International World Wide Web Conferences Steering Committee (2016)

15.

Gerlenter, N.: Advanced cross-site search attacks. https://owasp.org/www-pdf-archive//AppSecIL2016_AdvancedCrossSiteSearch_NethanelGelernter.pdf

16.

Gilad, Y., Herzberg, A.: Spying in the dark: TCP and tor traffic analysis. In: Fischer-Hübner, S., Wright, M. (eds.) PETS 2012. LNCS, vol. 7384, pp. 100–119. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31680-7_6CrossRef

17.

GitHub: XS-Search Attacks. https://github.com/barmey/xs-search

18.

Heiderich, M., Niemietz, M., Schuster, F., Holz, T., Schwenk, J.: Scriptless attacks: stealing the pie without touching the sill. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, pp. 760–771. ACM (2012)

19.

Huang, L.S., Moshchuk, A., Wang, H.J., Schecter, S., Jackson, C.: Clickjacking: attacks and defenses. In: Presented as Part of the 21st \(\{\)USENIX\(\}\) Security Symposium, \(\{\)USENIX\(\}\) Security 2012, pp. 413–428 (2012)

20.

Meyuhas, B., Herzberg, A., Gelernter, N.: Cross-site search attacks: unauthorized queries over private data (extended version), October 2020. https://www.researchgate.net/publication/344503497_Cross-Site_Search_Attacks_Unauthorized_Queries_over_Private_Data

21.

OWASP: OWASP/CSRFCheatSheet, June 2019. https://github.com/OWASP/CheatSheetSeries

22.

Same-site cookies RFC, April 2016. https://tools.ietf.org/html/draft-west-first-party-cookies-07

23.

Service Workers: An Introduction. https://developers.google.com/web/fundamentals/primers/service-workers/

24.

Smith, C.: 20 Amazing Gmail Statistics, June 2019. https://expandedramblings.com/index.php/gmail-statistics/

25.

Song, D.: Timing analysis of keystrokes and SSH timing attacks. In: Proceedings of 10th USENIX Security Symposium (2001)

26.

Van Goethem, T., Vanhoef, M., Piessens, F., Joosen, W.: Request and conquer: exposing cross-origin resource size. In: 25th \(\{\)USENIX\(\}\) Security Symposium, \(\{\)USENIX\(\}\) Security 2016, pp. 447–462 (2016)

27.

Zalewski, M.: The Tangled Web: A Guide to Securing Modern Web Applications. No Starch Press, San Francisco (2012)

28.

Zhang, Y., Juels, A., Reiter, M.K., Ristenpart, T.: Cross-tenant side-channel attacks in PaaS clouds. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp. 990–1003 (2014)

Titel: Cross-Site Search Attacks: Unauthorized Queries over Private Data
verfasst von: Bar Meyuhas
Nethanel Gelernter
Amir Herzberg
Verlag: Springer International Publishing
Buch: Cryptology and Network Security
Print ISBN: 978-3-030-65410-8

Electronic ISBN: 978-3-030-65411-5

Copyright-Jahr: 2020
DOI: https://doi.org/10.1007/978-3-030-65411-5_3

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"