Anybody know of a way to block this?
http://making-the-web.com/misc/sites-you-visit/nojs/
Full Version: Browser History Sniffing
Neowin Forums > Help & Discussion Center > Software Discussion & Assistance > Web Browser Discussion > Firefox (Gecko)
Quote -
Links open in new windows. Although it is not required for the exploit, meta refreshes must be enabled to view this demo. * In most configurations.
Have a read here: http://forums.mozillazine.org/viewtopic.php?f=7&t=859575
Basically: (in Firefox)
about:config
accessibility.blockautorefresh
Double click on: "accessibility.blockautorefresh"
Try http://making-the-web.com/misc/sites-you-visit/nojs/ again
This isn't anything new: Mozilla has documented this "flaw" since 2000. The reason that this isn't that serious is that they can't retrieve an arbitrary history: just if you have visited a specific URL (not even a particular domain or site!) that it asks for. So unless the attacker explicitly asks if you've been to http://example.org/47, it will never know that you've been to http://example.org/47. It can't find that out by probing http://example.org/, http://example.org/47?x, or even http://example.org/47/. It must probe http://example.org/47, verbatim. Brute-forcing every possible URL? Yea, good luck with that. Brute-forcing every possible URL over a network connection? I think this just won the Most Impractical Exploit Award.
Practically, the extent of this flaw is to make for a nice sensationalist parlor trick for use by some grandstanding website that claims to have "discovered" a hole that people had known about for a decade, capable of determining if you've ever been to a common site, like google.com. Utterly useless for any sort of meaningful attack. Not to mention, it's slow and burdensome on the attacker's server.
As for disabling META refreshes, that's silly. It's not going to save you from this "exploit"--it's used by this particular demo, and that's it. I can use this exploit to sniff your browser history regardless of whether you have disabled META refreshes. And disabling META refreshes in general is usually a pretty big hit on usability (for a selective block of META refreshes, you can use NoRedirect, but with respect to this sniffing exploit, it's completely irrelevant).
Practically, the extent of this flaw is to make for a nice sensationalist parlor trick for use by some grandstanding website that claims to have "discovered" a hole that people had known about for a decade, capable of determining if you've ever been to a common site, like google.com. Utterly useless for any sort of meaningful attack. Not to mention, it's slow and burdensome on the attacker's server.
As for disabling META refreshes, that's silly. It's not going to save you from this "exploit"--it's used by this particular demo, and that's it. I can use this exploit to sniff your browser history regardless of whether you have disabled META refreshes. And disabling META refreshes in general is usually a pretty big hit on usability (for a selective block of META refreshes, you can use NoRedirect, but with respect to this sniffing exploit, it's completely irrelevant).
You have to stop :visited from working, you could do a "same origin" restriction on it, change getComputedStyle to always return the default state, or just plain break it. It's not that much of a "flaw" anyway, as code.kliu.org said you have to guess the exact URL used, but if you're paranoid you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.
A general way on how to do it (it'll report lime if it's visited, red otherwise).
Edit: How about an even better true/false method.
A general way on how to do it (it'll report lime if it's visited, red otherwise).
CODE
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
<head>
<title>Test</title>
<style type="text/css">
a { left: 0px; }
a:visited { left: 1px; }
</style>
</head>
<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
<p><a href="http://www.google.com/">Google</a></p>
</body>
</html>
<html lang="en">
<head>
<title>Test</title>
<style type="text/css">
a { left: 0px; }
a:visited { left: 1px; }
</style>
</head>
<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
<p><a href="http://www.google.com/">Google</a></p>
</body>
</html>
Edit: How about an even better true/false method.
Thanks The_Decrytor and code.kliu.org!
This is what I love about Neowin! I'm a moron when it comes to coding but there are always some pretty BRILLIANT people on Neowin to set me straight.
I feel relaxed that it's such a difficult sniff to use and knowing it can be blocked if I wish by changing that layout.css.visited_links_enabled value.
Thanks again!
This is what I love about Neowin! I'm a moron when it comes to coding but there are always some pretty BRILLIANT people on Neowin to set me straight.
I feel relaxed that it's such a difficult sniff to use and knowing it can be blocked if I wish by changing that layout.css.visited_links_enabled value.
Thanks again!
Quote - (The_Decryptor @ Jul 3 2009, 01:40) 
you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.
A general way on how to do it (it'll report lime if it's visited, red otherwise).
Edit: How about an even better true/false method.
A general way on how to do it (it'll report lime if it's visited, red otherwise).
CODE
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
<head>
<title>Test</title>
<style type="text/css">
a { left: 0px; }
a:visited { left: 1px; }
</style>
</head>
<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
<p><a href="http://www.google.com/">Google</a></p>
</body>
</html>
<html lang="en">
<head>
<title>Test</title>
<style type="text/css">
a { left: 0px; }
a:visited { left: 1px; }
</style>
</head>
<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
<p><a href="http://www.google.com/">Google</a></p>
</body>
</html>
Edit: How about an even better true/false method.
I don't seem to have "layout.css.visited_links_enabled" in about:config (?)
Um I was a strong supporter for IE for many years, as:
If IE worked then Firefox could be checked
IE came with Windows
IE was required at MS Update Servers
So, how do I use that code again? (this looks to be the easiest option)
I know stoopy me, but what I do again in Firefox?
Yes real question.
It found no sites for me? 
Quote - (kimsland @ Jul 3 2009, 08:36)
I don't seem to have "layout.css.visited_links_enabled" in about:config (?)
Um I was a strong supporter for IE for many years, as:
If IE worked then Firefox could be checked
IE came with Windows
IE was required at MS Update Servers
So, how do I use that code again? (this looks to be the easiest option)
I know stoopy me, but what I do again in Firefox?
Yes real question.
Um I was a strong supporter for IE for many years, as:
If IE worked then Firefox could be checked
IE came with Windows
IE was required at MS Update Servers
So, how do I use that code again? (this looks to be the easiest option)
I know stoopy me, but what I do again in Firefox?
Yes real question.
Are you using Firefox 3.5? The preference doesn't exist in 3.0.
Oh
ok I'll update then !
Thanks
ok I'll update then !
Thanks
If anyone wants the lists of sites it uses, as well as how it works, look here :
http://making-the-web.com/misc/sites-you-visit/nojs/base.php
http://making-the-web.com/misc/sites-you-visit/nojs/base.php
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.