Browser History Sniffing

By Salgoth
in Web Browser Discussion & Support

 Share

Recommended Posts

Mentor

kimsland

Posted
Posted
Links open in new windows. Although it is not required for the exploit, meta refreshes must be enabled to view this demo. * In most configurations.

Have a read here: http://forums.mozillazine.org/viewtopic.php?f=7&t=859575

Basically: (in Firefox)

about:config

accessibility.blockautorefresh

Double click on: "accessibility.blockautorefresh"

Try http://making-the-web.com/misc/sites-you-visit/nojs/ again :)

Community Regular

code.kliu.org

Posted
Posted (edited)

This isn't anything new: Mozilla has documented this "flaw" since 2000. The reason that this isn't that serious is that they can't retrieve an arbitrary history: just if you have visited a specific URL (not even a particular domain or site!) that it asks for. So unless the attacker explicitly asks if you've been to http://example.org/47, it will never know that you've been to http://example.org/47. It can't find that out by probing http://example.org/, http://example.org/47?x, or even http://example.org/47/. It must probe http://example.org/47, verbatim. Brute-forcing every possible URL? Yea, good luck with that. Brute-forcing every possible URL over a network connection? I think this just won the Most Impractical Exploit Award.

Practically, the extent of this flaw is to make for a nice sensationalist parlor trick for use by some grandstanding website that claims to have "discovered" a hole that people had known about for a decade, capable of determining if you've ever been to a common site, like google.com. Utterly useless for any sort of meaningful attack. Not to mention, it's slow and burdensome on the attacker's server.

As for disabling META refreshes, that's silly. It's not going to save you from this "exploit"--it's used by this particular demo, and that's it. I can use this exploit to sniff your browser history regardless of whether you have disabled META refreshes. And disabling META refreshes in general is usually a pretty big hit on usability (for a selective block of META refreshes, you can use NoRedirect, but with respect to this sniffing exploit, it's completely irrelevant).

Edited by code.kliu.org
Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted (edited)

You have to stop :visited from working, you could do a "same origin" restriction on it, change getComputedStyle to always return the default state, or just plain break it. It's not that much of a "flaw" anyway, as code.kliu.org said you have to guess the exact URL used, but if you're paranoid you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
	<head>
		<title>Test</title>
		<style type="text/css">
			a { left: 0px; }
			a:visited { left: 1px; }
		</style>
	</head>
	<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
		<p><a href="http://www.google.com/">Google</a></p>
	</body>
</html>

Edit: How about an even better true/false method.

Edited by The_Decryptor
Mentor

Salgoth

Posted
  • Author
Posted

Thanks The_Decrytor and code.kliu.org!

This is what I love about Neowin! I'm a moron when it comes to coding but there are always some pretty BRILLIANT people on Neowin to set me straight.

I feel relaxed that it's such a difficult sniff to use and knowing it can be blocked if I wish by changing that layout.css.visited_links_enabled value.

Thanks again!

Mentor

kimsland

Posted
Posted
you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html lang="en">
	<head>
		<title>Test</title>
		<style type="text/css">
			a { left: 0px; }
			a:visited { left: 1px; }
		</style>
	</head>
	<body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));">
		<p><a href="http://www.google.com/">Google</a></p>
	</body>
</html>

Edit: How about an even better true/false method.

I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:

If IE worked then Firefox could be checked

IE came with Windows

IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)

I know stoopy me, but what I do again in Firefox?

Yes real question.

Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted
I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:

If IE worked then Firefox could be checked

IE came with Windows

IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)

I know stoopy me, but what I do again in Firefox?

Yes real question.

Are you using Firefox 3.5? The preference doesn't exist in 3.0.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Epic Games says Unreal Engine 6 will help developers "build content faster" using AI models

      By LoneWolfSL · Posted

      Epic Games says Unreal Engine 6 will help developers "build content faster" using AI models by Pulasthi Ariyasinghe Epic Games is rolling out the latest major update to Unreal Engine 5 today, and at the same time, the company also dropped some information on the next-generation version of the product, Unreal Engine 6. This was already revealed a few weeks ago alongside the new Rocket League upgrade reveal. The company says it is combining the features of Unreal Engine and Unreal Editor for Fortnite to create this new version of its popular media creation tool. On top of creating entire games, the new engine will also focus on letting developers operate large-scale live service titles more easily, whether by shipping content into their own ecosystems or into Fortnite. The use of large language models is also mentioned here, with Epic saying it will be a core part of the engine. "We see LLMs, generative AI models, and tools like Claude and Codex playing a central role in helping you build content faster while maintaining the creative control you need," adds the company. Here is the rundown of what's new about version 6 of Unreal Engine: With all these changes to the programming model, portability upgrades, and generative AI integration, Epic says the new version of the engine will "change a lot about how games are made." The company aims to ship Unreal Engine 6 into early access in late 2027, with a full release planned for 12-18 months later. Epic Games also dropped a lengthy blog post about the new Unreal Engine 5.8 update for game developers over here. The release is focused on delivering better performance, customization, and streamlined workflows for development teams. This will be the final major update for this version of the engine before Epic switches to focus fully on Unreal Engine 6's early access launch.
    • The 2TB Samsung 990 PRO NVMe SSD hits lowest price in over three months

      By notta · Posted

      Watch Louis Rossmann's recent experience on YouTube about trying to get a warranty replacement from Samsung. It's crazy.
    • Nearly half of American adults now use AI, but concerns are also growing

      By ad47uk · Posted

      That is the thing, how many of these people don't realise they are using AI? If they use Google Search they have no choice but to use AI. So yes, maybe half of American adults do use and I expect a lot of Uk adults do to, but I bet most of them don't realise it. Myself, i avoid the rubbish.
    • Nearly half of American adults now use AI, but concerns are also growing

      By excalpius · Posted

      They use FREE AI. They aren't paying for this meme-generating slopware...
    • Latest Rufus update improves new Windows 11 install method

      By Parallax Abstraction · Posted

      Gotta' buy that there Rufus guy a beer if I ever meet him. He makes good stuff.

  • Recent Achievements

    • One Month Later
      Vincian earned a badge
      One Month Later
    • First Post
      Jocimo earned a badge
      First Post
    • Week One Done
      suprememobiles48 earned a badge
      Week One Done
    • One Month Later
      Windows Guy earned a badge
      One Month Later
    • One Month Later
      Prasann earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      499
    2. 2
      +Edouard
      165
    3. 3
      PsYcHoKiLLa
      89
    4. 4
      Steven P.
      69
    5. 5
      neufuse
      65
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!