Yes, even the Tor browser can be spied on by this nasty code
Special report Computer science boffins have demonstrated a side-channel attack technique that bypasses recently-introduced privacy defenses, and makes even the Tor browser subject to tracking. The result: it is possible for malicious JavaScript in one web browser tab to spy on other open tabs, and work out which websites you’re visiting.
This information can be used to target adverts at you based on your interests, or otherwise work out the kind of stuff you’re into and collect it in safe-keeping for future reference.
Researchers Anatoly Shusterman, Lachlan Kang, Yarden Haskal, Yosef Meltser, Prateek Mittal, Yossi Oren, Yuval Yarom – from Ben-Gurion University of the Negev in Israel, the University of Adelaide in Australia, and Princeton University in the US – have devised a processor cache-based website fingerprinting attack that uses JavaScript for gathering data to identify visited websites.
The technique is described in a paper recently distributed through ArXiv called “Robust Website Fingerprinting Through the Cache Occupancy Channel.”
“The attack we demonstrated compromises ‘human secrets’: by finding out which websites a user accesses, it can teach the attacker things like a user’s sexual orientation, religious beliefs, political opinions, health conditions, etc.,” said Yossi Oren (Ben-Gurion University) and Yuval Yarom (University of Adelaide) in an email to The Register this week.
It’s thus not as serious as a remote attack technique that allows the execution of arbitrary code or exposes kernel memory, but Oren and Yarom speculate that there may be ways their browser fingerprinting method could be adapted to compromise computing secrets like encryption keys or vulnerable installed software.
In any event, the attack could have serious consequences for those using Tor in the belief that their website visits can be kept secret.
A side-channel attack (or “transient execution attack“) involves observing some portion of a computing system to collect measurements that can be used to infer otherwise privileged information. The Spectre, Meltdown, and Foreshadow vulnerabilities revealed this year all have the potential to be exploited via side-channel attack techniques.
Oren and Yarom explained their approach works at a more fundamental level than Spectre. “It works in places where Spectre cannot work (for example, across process boundaries), and the CPU patches built to protect against Spectre cannot stop it,” they said. “On the other hand, the Spectre attack is capable of recovering information at a much higher resolution than our attack.”
One of the ways these attacks have been mitigated is by limiting access to high-precision timers, by which side-channel data can be collected. When the Spectre and Meltdown vulnerabilities were first disclosed, for example, Mozilla said it would disable or reduce the precision of time sources in its Firefox browser.
But this latest browser fingerprinting technique doesn’t need a high-precision timer because it focuses on processor cache occupancy.
“Cache occupancy measures what percentage of the entire cache has been accessed over a certain time period,” explained Oren and Yarom. “The browser is very memory intensive, since it receives large amounts of data from the network and draws various outputs to the screen. This means it uses a significant portion of the cache as it loads a page.”
What’s more, it doesn’t depend on the layout of the cache, which makes cache layout randomization – a risk mitigation technique – useless for this particular approach. The attack is also unaffected by defenses against network-based fingerprinting, as when a browser fetches data from its response cache rather than the network or when network traffic shaping is employed.
Automatic identification
This fingerprinting attack involves using JavaScript to measure processor cache access latency over time as websites are loaded. These “memorygrams” are then compared via deep-learning techniques to a set of memorygrams collected by the attacker, with an eye toward automatically identifying similarities to establish a website visit. In other words, it is possible to determine which website someone’s looking at by the way their browser accesses the processor’s CPU cache while fetching and rendering on-screen the web pages. Malicious JavaScript in one tab can monitor cache accesses to identify patterns and fingerprint the sites visited by other tabs.
“‘Classical’ machine learning techniques require a human expert to find out which ‘features’ in the data are relevant for the attack,” explained Oren and Yarom. “There is a lot of research on the best features to use when performing other types of attacks. In deep learning, the computer acts as the expert and tries to find these features itself. This allows us to go straight from the data to the results. Perhaps a human researcher will be able to find better features than our deep learning algorithm did, and improve the attack even further.”
The boffins considered two scenarios: a closed world data set, where 100 memorygrams for each of 100 websites, are evaluated; and an open world data set, where 100 sensitive web pages must be distinguished from 5,000 other websites.
Using mainstream browsers on the closed set, the researchers were able to accurately classify 70 to 90 per cent of website visits. Applied to Tor, the attack managed accuracy of only 47 per cent, but when other data was considered, accuracy increased to 72 per cent. Results were similar for the open world data set – 70 to 90 per cent, with Tor identification at 83 per cent if the researchers considered not only the top output, but also checked to see whether it’s one of the top five detected results.
If the goal was simply to determine whether the website visited was sensitive or non-sensitive, accuracy increased to more than 99 per cent in the open world data set.
Oren and Yarom say their work shows that efforts to defend against side-channel attacks by reducing access to precision timing have been for naught.
“In this work we show that the whole approach is futile – we simply do not need high-resolution timers for the attack,” they said. “Similarly, some approaches for protecting from Spectre segregate sites into multiple processes. We show that this is not sufficient. We show that we can spy from one browser tab on another and even from one browser on other browsers running on the computer.”
The takeaway, they contend, is that anything short of running a single browser tab at any one point in time poses a privacy risk: if you open a second tab, JavaScript in it can snoop on the other tab. Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. And they say virtualization should be seen as a convenience feature rather than a security feature.
“If you want to visit sensitive and non-sensitive websites at the same time, use two different computers,” they said. ®
Source: The Register