Browser History Sniffing

July 2, 2009

Anybody know of a way to block this?

http://making-the-web.com/misc/sites-you-visit/nojs/

July 2, 2009

Links open in new windows. Although it is not required for the exploit, meta refreshes must be enabled to view this demo. * In most configurations.

Have a read here: http://forums.mozillazine.org/viewtopic.php?f=7&t=859575

Basically: (in Firefox)

about:config

accessibility.blockautorefresh

Double click on: "accessibility.blockautorefresh"

Try http://making-the-web.com/misc/sites-you-visit/nojs/ again :)

July 2, 2009

This isn't anything new: Mozilla has documented this "flaw" since 2000. The reason that this isn't that serious is that they can't retrieve an arbitrary history: just if you have visited a specific URL (not even a particular domain or site!) that it asks for. So unless the attacker explicitly asks if you've been to http://example.org/47, it will never know that you've been to http://example.org/47. It can't find that out by probing http://example.org/, http://example.org/47?x, or even http://example.org/47/. It must probe http://example.org/47, verbatim. Brute-forcing every possible URL? Yea, good luck with that. Brute-forcing every possible URL over a network connection? I think this just won the Most Impractical Exploit Award.

Practically, the extent of this flaw is to make for a nice sensationalist parlor trick for use by some grandstanding website that claims to have "discovered" a hole that people had known about for a decade, capable of determining if you've ever been to a common site, like google.com. Utterly useless for any sort of meaningful attack. Not to mention, it's slow and burdensome on the attacker's server.

As for disabling META refreshes, that's silly. It's not going to save you from this "exploit"--it's used by this particular demo, and that's it. I can use this exploit to sniff your browser history regardless of whether you have disabled META refreshes. And disabling META refreshes in general is usually a pretty big hit on usability (for a selective block of META refreshes, you can use NoRedirect, but with respect to this sniffing exploit, it's completely irrelevant).

Edited July 2, 2009 by code.kliu.org

July 2, 2009

You have to stop :visited from working, you could do a "same origin" restriction on it, change getComputedStyle to always return the default state, or just plain break it. It's not that much of a "flaw" anyway, as code.kliu.org said you have to guess the exact URL used, but if you're paranoid you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.

A general way on how to do it (it'll report lime if it's visited, red otherwise).

&lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"&gt;
&lt;html lang="en"&gt;
	&lt;head&gt;
		&lt;title&gt;Test&lt;/title&gt;
		&lt;style type="text/css"&gt;
			a { left: 0px; }
			a:visited { left: 1px; }
		&lt;/style&gt;
	&lt;/head&gt;
	&lt;body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));"&gt;
		&lt;p&gt;&lt;a href="http://www.google.com/"&gt;Google&lt;/a&gt;&lt;/p&gt;
	&lt;/body&gt;
&lt;/html&gt;

Edit: How about an even better true/false method.

Edited July 2, 2009 by The_Decryptor

July 2, 2009

Thanks The_Decrytor and code.kliu.org!

This is what I love about Neowin! I'm a moron when it comes to coding but there are always some pretty BRILLIANT people on Neowin to set me straight.

I feel relaxed that it's such a difficult sniff to use and knowing it can be blocked if I wish by changing that layout.css.visited_links_enabled value.

Thanks again!

July 2, 2009

you can disable :visited by going to "about:config" and setting "layout.css.visited_links_enabled" to false.
A general way on how to do it (it'll report lime if it's visited, red otherwise).
&lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"&gt;
&lt;html lang="en"&gt;
	&lt;head&gt;
		&lt;title&gt;Test&lt;/title&gt;
		&lt;style type="text/css"&gt;
			a { left: 0px; }
			a:visited { left: 1px; }
		&lt;/style&gt;
	&lt;/head&gt;
	&lt;body onload="alert('Visited Google: ' + Boolean(parseInt(document.defaultView.getComputedStyle(document.getElementsByTagName('a')[0],null).getPropertyValue('left'))));"&gt;
		&lt;p&gt;&lt;a href="http://www.google.com/"&gt;Google&lt;/a&gt;&lt;/p&gt;
	&lt;/body&gt;
&lt;/html&gt;
Edit: How about an even better true/false method.

I don't seem to have "layout.css.visited_links_enabled" in about:config (?)

Um I was a strong supporter for IE for many years, as:

If IE worked then Firefox could be checked

IE came with Windows

IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)

I know stoopy me, but what I do again in Firefox?

Yes real question.

July 2, 2009

It found no sites for me? :p

July 3, 2009

I don't seem to have "layout.css.visited_links_enabled" in about:config (?)
Um I was a strong supporter for IE for many years, as:

If IE worked then Firefox could be checked

IE came with Windows

IE was required at MS Update Servers

So, how do I use that code again? (this looks to be the easiest option)

I know stoopy me, but what I do again in Firefox?

Yes real question.

Are you using Firefox 3.5? The preference doesn't exist in 3.0.

July 3, 2009

Oh

ok I'll update then !

Thanks :)

July 3, 2009

If anyone wants the lists of sites it uses, as well as how it works, look here :

http://making-the-web.com/misc/sites-you-visit/nojs/base.php

Sign In

Browser History Sniffing

Recommended Posts

Salgoth

Link to comment

Share on other sites

kimsland

Link to comment

Share on other sites

code.kliu.org

Link to comment

Share on other sites

The_Decryptor Veteran

Link to comment

Share on other sites

Salgoth

Link to comment

Share on other sites

kimsland

Link to comment

Share on other sites

troist

Link to comment

Share on other sites

The_Decryptor Veteran

Link to comment

Share on other sites

kimsland

Link to comment

Share on other sites

Snowl

Link to comment

Share on other sites

Recently Browsing 0 members

Posts

Recent Achievements

Popular Contributors

Tell a friend