Welcome Guest! To access all forums & features, please register an account or sign-in. → Why register?


Microsoft says Xbox One games do require a internet connection in Back Page News

Browser History Sniffing

Started by Salgoth, Jul 02 2009 13:50

9 replies to this topic - - - - -

#1 Salgoth

    Outwitted but Enlightened

  • 1,226 posts
    • Joined: 02-January 04

Posted 02 July 2009 - 13:50

Anybody know of a way to block this?

http://making-the-we...you-visit/nojs/

Ad Bot


#2 kimsland

    Computer Technician

  • 1,690 posts
    • Joined: 10-March 07

Posted 02 July 2009 - 14:44

Quote

Links open in new windows. Although it is not required for the exploit, meta refreshes must be enabled to view this demo. * In most configurations.

Have a read here: http://forums.mozill...hp?f=7&t=859575

Basically: (in Firefox)

about:config
accessibility.blockautorefresh
Double click on: "accessibility.blockautorefresh"

Try http://making-the-we...you-visit/nojs/ again :)

#3 code.kliu.org

    Curmudgeon

  • 374 posts
    • Joined: 25-May 09
  • Location: .us

Posted 02 July 2009 - 15:28

This isn't anything new: Mozilla has documented this "flaw" since 2000. The reason that this isn't that serious is that they can't retrieve an arbitrary history: just if you have visited a specific URL (not even a particular domain or site!) that it asks for. So unless the attacker explicitly asks if you've been to http://example.org/47, it will never know that you've been to http://example.org/47. It can't find that out by probing http://example.org/, http://example.org/47?x, or even http://example.org/47/. It must probe http://example.org/47, verbatim. Brute-forcing every possible URL? Yea, good luck with that. Brute-forcing every possible URL over a network connection? I think this just won the Most Impractical Exploit Award.

Practically, the extent of this flaw is to make for a nice sensationalist parlor trick for use by some grandstanding website that claims to have "discovered" a hole that people had known about for a decade, capable of determining if you've ever been to a common site, like google.com. Utterly useless for any sort of meaningful attack. Not to mention, it's slow and burdensome on the attacker's server.

As for disabling META refreshes, that's silly. It's not going to save you from this "exploit"--it's used by this particular demo, and that's it. I can use this exploit to sniff your browser history regardless of whether you have disabled META refreshes. And disabling META refreshes in general is usually a pretty big hit on usability (for a selective block of META refreshes, you can use NoRedirect, but with respect to this sniffing exploit, it's completely irrelevant).

Edited by code.kliu.org, 02 July 2009 - 15:33.

#4 The_Decryptor

    THE ALPHA CEPH!

  • 18,349 posts
    • Joined: 28-September 02
  • Location: Sol System
  • OS: WinLin X 10.9 Ill-tempered Badger

Posted 02 July 2009 - 15:40

You have to stop :visited from working, you could do a "same origin" restriction on it, change getComputedStyle to always return the default state, or just plain break it. It's not that much of a "flaw" anyway, as code.kliu.org said you have to guess the exact URL used, but if you're paranoid you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
	<head>
		<title>Test</title>
		<style type="text/css">
			a { left: 0px; }
			a:visited { left: 1px; }
		</style>
	</head>
	<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
		<p><a href="http://www.google.com/">Google</a></p>
	</body>
</html>
Edit: How about an even better true/false method.

Edited by The_Decryptor, 02 July 2009 - 15:51.

#5 OP Salgoth

    Outwitted but Enlightened

  • 1,226 posts
    • Joined: 02-January 04

Posted 02 July 2009 - 15:58

Thanks The_Decrytor and code.kliu.org!

This is what I love about Neowin! I'm a moron when it comes to coding but there are always some pretty BRILLIANT people on Neowin to set me straight.

I feel relaxed that it's such a difficult sniff to use and knowing it can be blocked if I wish by changing that layout.css.visited_links_enabled value.

Thanks again!

#6 kimsland

    Computer Technician

  • 1,690 posts
    • Joined: 10-March 07

Posted 02 July 2009 - 22:36

View PostThe_Decryptor, on Jul 3 2009, 01:40, said:

you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
	<head>
		<title>Test</title>
		<style type="text/css">
			a { left: 0px; }
			a:visited { left: 1px; }
		</style>
	</head>
	<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
		<p><a href="http://www.google.com/">Google</a></p>
	</body>
</html>
Edit: How about an even better true/false method.

I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:
If IE worked then Firefox could be checked
IE came with Windows
IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)
I know stoopy me, but what I do again in Firefox?
Yes real question.

#7 troist

    Resident Elite

  • 1,210 posts
    • Joined: 22-March 05
  • Location: Blighty

Posted 02 July 2009 - 22:40

It found no sites for me? :p

#8 The_Decryptor

    THE ALPHA CEPH!

  • 18,349 posts
    • Joined: 28-September 02
  • Location: Sol System
  • OS: WinLin X 10.9 Ill-tempered Badger

Posted 03 July 2009 - 03:07

View Postkimsland, on Jul 3 2009, 08:36, said:

I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:
If IE worked then Firefox could be checked
IE came with Windows
IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)
I know stoopy me, but what I do again in Firefox?
Yes real question.
Are you using Firefox 3.5? The preference doesn't exist in 3.0.

#9 kimsland

    Computer Technician

  • 1,690 posts
    • Joined: 10-March 07

Posted 03 July 2009 - 03:12

Oh
ok I'll update then !

Thanks :)

#10 Snowl

    ‮i wasted 10 seconds of your time

  • 1,898 posts
    • Joined: 01-December 08
  • Location: Australia.

Posted 03 July 2009 - 03:42

If anyone wants the lists of sites it uses, as well as how it works, look here :
http://making-the-we...t/nojs/base.php
Back to Web Browser Discussion & Support · Next Unread Topic →


  1. Quick Nav
  2. Neowin Forums
  3. → Technical Help & Support
  4. → Software Discussion & Support
  5. → Web Browser Discussion & Support