Saturday, December 3, 2011

Timing Attacks on CSS Shaders

CSS Shaders is a new feature folks from Adobe, Apple, and Opera have proposed to the W3C CSS-SVG Effects Task Force.  Rather than being limited to pre-canned effects, such as gradients and drop shadows, CSS Shaders would let web developers apply arbitrary OpenGL shaders to their content.  That makes for some really impressive demos.  Unfortunately, CSS Shaders has a security problem.

To understand the security problem with CSS Shaders, it's helpful to recall a recent security issue with WebGL.  Similar to CSS Shaders, WebGL lets developers use OpenGL shaders in their web applications.  Originally, WebGL let these shaders operate on arbitrary textures, including textures fetched from other origins.  Unfortunately, this design was vulnerable to a timing attack because the runtime of OpenGL shaders can depend on their inputs.

Using the shader code below, James Forshaw built a compelling proof-of-concept attack that extracted pixel values from a cross-origin image using WebGL:
for (int i = 0; i <= 1024; i += 1) {
  // Exit loop early depending on pixel brightness
  currCol.r -= 1.0;
  if (currCol.r <= 0.0) {
    currCol.r = 0.0;
    break;
  }
}
Timing attacks are difficult to mitigate because once the sensitive data is present in the timing channel it's very difficult to remove.  Using techniques like bucketing, we can limit the number of bits an attacker can extract per second, but, given enough time, the attacker can still steal the sensitive data.  The best solution is the one WebGL adopted: prevent sensitive data from entering the timing channel.  WebGL accomplished this by requiring cross-origin textures to be authorized via Cross-Origin Resource Sharing.

There's a direct application of this attack to CSS Shaders.  Because web sites are allowed to display content that they are not allowed to read, an attacker can use a Forshaw-style CSS shader read confidential information via the timing channel.  For example, a web site could use CSS shaders to extract your identity from an embedded Facebook Like button.  More subtly, a web site could extract your browsing history bypassing David Baron's defense against history sniffing.

The authors of the CSS Shaders proposal are aware of these issues.  In the Security Considerations section of their proposal, they write:
However, it seems difficult to mount such an attack with CSS shaders because the means to measure the time taken by a cross-domain shader are limited.
Now, I don't have a proof-of-concept attack, but this claim is fairly dubious.  The history of timing attacks, including other web timing attacks, teaches us that even subtle leaks in the timing channel can lead to practical attacks.  Given that we've seen practical applications of the WebGL version of this attack, it seems quite likely CSS Shaders are vulnerable to timing attacks.

Specifically, there are a number of mechanisms for timing rendering.  For example, MozBeforePaint and MozAfterPaint provide a mechanism for measuring paint times directly.  Also, the behavior of requestAnimationFrame contains information about rendering times.

Without a proof-of-concept attack we cannot be completely certain that these attacks on CSS Shaders are practical, but waiting for proof-of-concept attacks before addressing security concerns isn't a path that leads to security.

374 comments:

  1. I've also been wondering whether SVG filters could be used for a similar attack. SVG filters aren't programmable like shaders are, so you couldn't directly affect the timing. However it might be possible to make a filter that is quicker for a certain pixel values due to various optimisations in the filter algorithms (e.g. a black pixel might be very quick to process because the output would always be zero for a particular filter). Or you could find a combination of filters that hits some edge case that takes particularly long to process for some pixel values (maybe involving alpha or something)

    ReplyDelete
  2. Yeah, Dean Jackson has suggested that something like that might be possible. It definitely sounds worth experimenting with.

    ReplyDelete
  3. Parallel to this you can plan for the layout's response when the window expands. "Abu Dhabi Website Design" It will then include one or two sidebars and several other elements.

    ReplyDelete
  4. a essay editor will transform ones essay coming from for ordinary custom essay writing services uk in to a refined AS WELL AS concise essay. you have quite possibly spent the considerable amount connected with day a lot more than your own academic assignment. your own next step can be in order to polish It to help perfection. This can be possible pertaining to you, like a writer, to be able to overlook the errors that you can have committed.

    ReplyDelete
  5. Frequent people demand special discounts and also other cheap business arrivals. It is because that they vacation on a day-to-day basis. Few air arrivals corporations consider these kind of people while many will not.discount travel

    ReplyDelete
  6. world-wide-web design deals from the location regarding designing a site AS WELL AS on the lengthy operate updating AS WELL AS maintaining. from the world wide web boom, every firm wants to have an on the internet footprint AND the website is The best way to showcase one's skills IN ADDITION TO business IN ADDITION TO kindle the curiosity regarding potential customers.CMS for web designers

    ReplyDelete
  7. The HTML reports can be shown utilizing diverse yield styles. HTML labels were initially intended to characterize the substance of a report. Falling web-designing Styles sheets characterize how HTML components are to be shown.

    ReplyDelete
  8. Primeau Productions is your current full-service online video media production company, throughout company intended for over 30 years. Primeau Productions owes its success immediately towards the results The idea achieves due to the clients. i are a results-oriented company, As established via MY PERSONAL published listing of long-term, repeat customers.keynote-speaker-demo-video-production

    ReplyDelete
  9. Great information about the css and it related create digital tickets . Now this time we need this type of info to get success. Once again thanks for the Css information.

    ReplyDelete
  10. Thanks for sharing such a great article and it's helpful for everyone. Great Post! Hyderabad Online Florist

    ReplyDelete
  11. The best solution is the one WebGL adopted: prevent sensitive data from entering the timing channel. hvac repair denver

    ReplyDelete
  12. Thank you for your post.Really looking forward to read more. Cool.
    Diwali wishes 2015

    ReplyDelete
  13. Thanks for sharing, this is a fantastic blog.Thanks Again. Much obliged.
    diwali sms images 2015

    ReplyDelete
  14. I am so grateful for your blog.Really thank you! Cool
    Prem ratan dhan payo torrent

    ReplyDelete
  15. It's a fact that your blog posts are so unique and interesting and I enjoys a lot while reading your posts because you explained your post very deeply in a very easy and clear language. Thanks for your support and Happy Blogging :D

    hostgator black friday 2015

    happy new year 2016
    new year 2016

    ReplyDelete
  16. Really impressive post. I read it whole and going to share it with my social circules. I enjoyed your article and planning to rewrite it on my own blog.
    mahjong |geometry dash | kizi | hulk|agario | minecraft|halloween | pacman| | sniper games | games

    ReplyDelete
  17. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  18. I really like and appreciate your blog.Thanks Again. Really Cool.
    New year wishes 2016
    New year wishes

    ReplyDelete
  19. I appreciate you sharing this article.Thanks Again. Much obliged.
    New year images 2016
    New year pictures 2016

    ReplyDelete
  20. Really appreciate you sharing this blog.Really looking forward to read more. Much obliged.
    New year wishes 2016

    Happy new year wishes 2016

    ReplyDelete
  21. Thanks for the blog post.Really looking forward to read more. Will read on…
    Happy new year quotes

    New year quotes 2016

    ReplyDelete
  22. This is really great work. Thank you for sharing such a useful information here in the blog.
    Voodoo Spells

    ReplyDelete
  23. A great possibility for me and it was a superb knowledge to view this site. Very difficult to uncover these beneficial web page or web site. I have many devices and achieving proper picture of these worked well and energy continues to be seeing about this weblog. Often my own intend to make my personal site as well as my
    agario
    pacman
    plants vs zombies
    solitaire
    happy wheels
    car games

    ReplyDelete
  24. Crazy Bulk Australia 100% Safe and Legal Steroids

    Click Here To Avail Buy 2 Get 1 Free Discount Offer

    ReplyDelete
  25. Thanks for sharing the information. It is very useful for my future. keep sharing
    A good blog.
    Signature:
    i like play happy wheels games online and play games happy wheels demo full and game zombie tsunami , retrica apk , retrica download , happy wheels demo , agario

    ReplyDelete
  26. It's a fact that your blog posts are so unique and interesting and I enjoys a lot while reading your posts because you explained your post very deeply in a very easy and clear language. Thanks for your support and Happy Blogging :D
    HostGatorCouponCodesFactory

    ReplyDelete
  27. http://republicdayquotes2016.com
    http://republicdayquotes2016.com/happy-26th-january-republic-day-pictures/
    http://republicdayquotes2016.com/indian-flag-pictures-images-for-republic-day-2016/
    http://republicdayquotes2016.com/happy-republic-day-2016-sms-wishes/
    http://republicdayquotes2016.com/happy-republic-day-quotes-in-hindi/
    http://republicdayquotes2016.com/why-is-republic-day-celebrated-in-india-on-26th-january/
    http://republicdayquotes2016.com/happy-republic-day-2016-quotes-in-english/
    http://republicdayquotes2016.com/happy-republic-day-2016-speech-essay-paragraph-for-school-students/
    http://republicdayquotes2016.com/republic-day-2016-slogan-poster-sayings/
    http://republicdayquotes2016.com/happy-republic-day-2016-whatsapp-status-whatsapp-dp/
    http://republicdayquotes2016.com/famous-republic-day-images-quotes-26th-january-2016/
    Republic Day 2016 Slogan | Poster | Sayings

    Happy Republic Day 2016 Whatsapp Status & Whatsapp DP

    Famous Republic Day Images with Quotes on 26th January 2016

    Happy Republic Day 2016 Speech | Essay | Paragraph for School Students

    Happy Republic Day 2016 Quotes in English

    Happy 26th January Republic Day Pictures

    Indian Flag Pictures – Images for Republic Day 2016 (गणतंत्र दिवस)

    Happy Republic Day 2016 Sms Wishes

    Happy Republic Day 2016 Quotes in Hindi

    Why is Republic Day Celebrated in India on 26th January


    ReplyDelete
  28. i THINK THERE IS SOME grammatical mistakes mothers day 2016 quotes and some spelling mistakes too Fathers day 2016 quotes and check iphone 7 too Apple iPhone 7 and soon cbse result is going to live on the website CBSE RESULT 2016

    ReplyDelete
  29. i THINK THERE IS SOME grammatical mistakes mothers day 2016 quotes and some spelling mistakes too Fathers day 2016 quotes and check iphone 7 too Apple iPhone 7 and soon cbse result is going to live on the website CBSE RESULT 2016

    ReplyDelete
  30. i THINK THERE IS SOME grammatical mistakes mothers day 2016 quotes and some spelling mistakes too Fathers day 2016 quotes and check iphone 7 too Apple iPhone 7 and soon cbse result is going to live on the website CBSE RESULT 2016

    ReplyDelete
  31. Kasse neuesten und Bilder Tag 2016 der frisch Valentine, Zitate, Tapeten und alles über diese valentinstagsgeschenk für männer 2016

    ReplyDelete
  32. I will take a few main sections to be included in my article. Hopefully you'll agree. Thank you. descargar facebook , baixar whatsapp , whatsapp messenger , mobogenie , mobogenie , baixar facebook , baixar facebook

    ReplyDelete
  33. Superb Post it really helpful for me ,And also can u please help me to fix my website design as well.

    freelancer singapore

    ReplyDelete
  34. It is a really nice and awesome post.....by reading this i understand that you are awesome... Thanks, Superb Post it really helpful for me ,And also can u please help me to fix my website design as well.

    If you wish to be able to learn more about how to optimize your website, then you should try to visit the site novage.com.sg - best web design company singapore

    ReplyDelete
  35. Thanks-a-mundo for the article post.Really thank you! Want more.
    CBSE Result 12th Class

    ReplyDelete
  36. Very good post.Really looking forward to read more. Want more
    Advance Happy Holi Wishes

    ReplyDelete
  37. I appreciate you sharing this blog.Really looking forward to read more. Will read on…
    Holi Pictures 2016 Greeting Cards

    ReplyDelete
  38. This is one awesome blog post.Really thank you! Really Great.
    CBSE 10th Result Nic.in

    ReplyDelete
  39. The content is great, and you’re an educated writer unlike most of the blogs.thanks for the post.

    Buying used dump trucks?

    ReplyDelete
  40. Wow !! It's great info. I really love this information but you can have more information regarding this subject on website.

    ReplyDelete
  41. Have you ever met someone who liked the similar readings that you read? Its amazing to read inspirational quotes or love quotes for her to get better in life.

    ReplyDelete
  42. Posts shared useful information and meaningful life, I'm glad to be reading this article and hope to soon learn the next article. thank you
    Signature:
    Download retrica online includes more than eighty different filters with many different styles and include retrica indir , and zombie tsunami is the ideal game for anyone who loves the running game genre and happy wheels , agario , happywheels , agar ,

    ReplyDelete
  43. It sits on the rack and you are out the cash. With utilized computer games, you can keep away from that.

    gamehere

    ReplyDelete
  44. a portion of the top utilized computer game frameworks and what the diversions are similar to with each

    http://snailbobx.com

    ReplyDelete
  45. Playstation 1, including Crash Bandicoot, an amusement in the style of Mario and Sonic, which can be a considerable measure of fun.

    gunbloodx

    ReplyDelete
  46. Nice and informative post. thanks to share with us.
    Latest Jobs

    ReplyDelete
  47. Free online web gaming had blasted for as far back as 10 years and now there is an expansive gathering

    game homepage

    ReplyDelete
  48. the gaming a huge number of the easygoing diversion players, web entryways, distributers and designers.

    gamehere

    ReplyDelete
  49. Regardless of the possibility that gifted diversion engineers are still in constrained supply contrasted with the entrances and distributers of best free program amusements

    playhere

    ReplyDelete
  50. I appreciated looking at your post.Wholesale Womens Latex Waist Training Corsets, Fajas

    Neon Waist Trainer China Manufacturer|Latexcorsets.com, Great quality fashion

    manufactured with quality materials.http://www.latexcorsets.com/

    ReplyDelete
  51. Keep publishing and I will definitely be back again soon. Many thanks and take care.Wholesale Vintage Pin Up Lingerie Burlesque Costumes Corsets, 1950s burlesque lingerie and costumes for pin up girls and performers.|Latexcorsets.com

    ReplyDelete
  52. rubber waist cincher wholesale http://www.latexcorsets.com/
    wholesale latex waist training corset http://www.latexcorsets.com/latex-waist-training-corsets-c-207.html
    cheap petticoats for women http://www.latexcorsets.com/petticoat-c-195.html
    peasant burlesque corset http://www.latexcorsets.com/burlesque-corsets-c-199.html

    ReplyDelete
  53. This comment has been removed by the author.

    ReplyDelete

  54. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  55. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  56. Happy Mothers Day Images 2016


    Check Out some latest and new Mothers day images in HD for wishing your mother and try to impress her. we have huge collection of Happy mothers day images 2016


    http://www.motherday2016.com/happy-mothers-day-images-2016/

    ReplyDelete

  57. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again.

    - quotes about love
    - panama papers

    ReplyDelete
  58. I truly believe that everything that we do and everyone that we meet is put in our path for a purpose. There are no accidents; we're all teachers - if we're willing to pay attention to the lessons we learn, trust our positive instincts and not be afraid to take risks or wait for some miracle to come knocking at our door.
    - Quotes about love
    - Fancam Kpop

    ReplyDelete
  59. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die
    Hi! I’ve been reading your blog for a while now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    tank trouble
    tank trouble

    earn to die 1

    earn to die 2

    earn to die 3

    tank trouble 4
    tank trouble 3
    tank trouble 2

    ReplyDelete
  60. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!

    hotmail sign in Hotmail is an email account of Microsoft Corporation. Like Google’s Gmail, it is full of the features of a regular email.

    hotmail login Hotmail was previously a quite popular email service. It has the features and utilities similar to other email services, but users encountered many annoying issues, and even lost fees they had paid for this service.


    recover hotmail password Therefore, there are many users who have a registered Hotmail account but no longer wish to use it as they are unhappy with the service.

    sign in to Hotmail  At this time, some users sought to remove their Hotmail account, but has some difficulties as it is a complicated process.

    ReplyDelete
  61. Thanks to the nomination Heather! We just did our post and experienced a blast! None of ours assess in your vibrant hues nevertheless… super impressive!
    Apple iPhone 7 release Date
    iPhone 7 release datE

    ReplyDelete
  62. Thanks for the best blog.it was very useful for me.keep sharing such idea
    s in the future as well.this was actually what i was looking for,and i
    am glad to came here
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  63. this blog is really helpful. i found very interesting things here. i am going to read this blog daily and will refer it to some of my friends are blogger.
    www.mahresult.nic.in
    ssc result 2016 online
    box office collection of sultan

    ReplyDelete
  64. Happy Mothers day Images 2016 Happy mothers day 2016 HD Images Happy Mothers day Wallpapers Happy mothers day Pics 2016 Happy Mothers day Pictures Happy mothers day Cards Happy Mothers day gifts ideas Happy Mothers day craft Ideas Happy Mothers day 2016 Free images download Happy Mothers day in heaven images Happy Mothers day Funny Images Happy Mothers day 2016 Love Quotes
    www.happymothersday2016images.com

    Happy Mothers Day Images Facebook


    Top 10 Easy Diy Mother’s Day 2016 Gifts Ideas

    Happy Mothers Day 2016 Cards

    Happy Mothers Day Images Australia

    Happy Mothers Day Images Arabic

    Happy Mothers Day Images Pinterest

    Happy Mothers Day Images Whatsapp

    Happy Mothers Day Poems

    Happy Mothers Day Gifts for mom

    Happy Mothers Day Messages


    Happy Mothers Day Status for facebook

    ReplyDelete
  65. Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes

    Strike Force Heroes 2

    Strike Force Heroes 3

    Strike Force Heroes 4

    Here are the simple steps to add an email address to your Hotmail contacts
    Hotmail Login

    Hotmail Sign In

    Sign In To Hotmail

    Recover Hotmail Password

    Create Hotmail Account

    Thanks for sharing nice information with us.

    ReplyDelete
  66. Mothers Day Poems in English 2016


    Check Out some latest and new Mothers Day Poems in English 2016 for wishing your mother and try to impress her. we have huge collection of Mothers Day Poems in English 2016

    http://www.motherday2016.com/mothers-day-poems-in-english-2016/

    ReplyDelete
  67. Thanks for sharing. I hope it will be helpful for too many people that are searching for this topic.
    shooting games | dog games | fighting games | mickey mouse games

    ReplyDelete
  68. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    Tank trouble
    Hi! I’ve been reading your blog for a while
    now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    Earn to die

    Barron Games

    Subble shooter

    Tank trouble

    ReplyDelete
  69. Good to know that such kind of posts are there to help ignorant and novice people.

    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  70. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete