Saturday, December 3, 2011

Timing Attacks on CSS Shaders

CSS Shaders is a new feature folks from Adobe, Apple, and Opera have proposed to the W3C CSS-SVG Effects Task Force.  Rather than being limited to pre-canned effects, such as gradients and drop shadows, CSS Shaders would let web developers apply arbitrary OpenGL shaders to their content.  That makes for some really impressive demos.  Unfortunately, CSS Shaders has a security problem.

To understand the security problem with CSS Shaders, it's helpful to recall a recent security issue with WebGL.  Similar to CSS Shaders, WebGL lets developers use OpenGL shaders in their web applications.  Originally, WebGL let these shaders operate on arbitrary textures, including textures fetched from other origins.  Unfortunately, this design was vulnerable to a timing attack because the runtime of OpenGL shaders can depend on their inputs.

Using the shader code below, James Forshaw built a compelling proof-of-concept attack that extracted pixel values from a cross-origin image using WebGL:
for (int i = 0; i <= 1024; i += 1) {
  // Exit loop early depending on pixel brightness
  currCol.r -= 1.0;
  if (currCol.r <= 0.0) {
    currCol.r = 0.0;
    break;
  }
}
Timing attacks are difficult to mitigate because once the sensitive data is present in the timing channel it's very difficult to remove.  Using techniques like bucketing, we can limit the number of bits an attacker can extract per second, but, given enough time, the attacker can still steal the sensitive data.  The best solution is the one WebGL adopted: prevent sensitive data from entering the timing channel.  WebGL accomplished this by requiring cross-origin textures to be authorized via Cross-Origin Resource Sharing.

There's a direct application of this attack to CSS Shaders.  Because web sites are allowed to display content that they are not allowed to read, an attacker can use a Forshaw-style CSS shader read confidential information via the timing channel.  For example, a web site could use CSS shaders to extract your identity from an embedded Facebook Like button.  More subtly, a web site could extract your browsing history bypassing David Baron's defense against history sniffing.

The authors of the CSS Shaders proposal are aware of these issues.  In the Security Considerations section of their proposal, they write:
However, it seems difficult to mount such an attack with CSS shaders because the means to measure the time taken by a cross-domain shader are limited.
Now, I don't have a proof-of-concept attack, but this claim is fairly dubious.  The history of timing attacks, including other web timing attacks, teaches us that even subtle leaks in the timing channel can lead to practical attacks.  Given that we've seen practical applications of the WebGL version of this attack, it seems quite likely CSS Shaders are vulnerable to timing attacks.

Specifically, there are a number of mechanisms for timing rendering.  For example, MozBeforePaint and MozAfterPaint provide a mechanism for measuring paint times directly.  Also, the behavior of requestAnimationFrame contains information about rendering times.

Without a proof-of-concept attack we cannot be completely certain that these attacks on CSS Shaders are practical, but waiting for proof-of-concept attacks before addressing security concerns isn't a path that leads to security.

601 comments:

  1. I've also been wondering whether SVG filters could be used for a similar attack. SVG filters aren't programmable like shaders are, so you couldn't directly affect the timing. However it might be possible to make a filter that is quicker for a certain pixel values due to various optimisations in the filter algorithms (e.g. a black pixel might be very quick to process because the output would always be zero for a particular filter). Or you could find a combination of filters that hits some edge case that takes particularly long to process for some pixel values (maybe involving alpha or something)

    ReplyDelete
  2. Yeah, Dean Jackson has suggested that something like that might be possible. It definitely sounds worth experimenting with.

    ReplyDelete
  3. Parallel to this you can plan for the layout's response when the window expands. "Abu Dhabi Website Design" It will then include one or two sidebars and several other elements.

    ReplyDelete
  4. a essay editor will transform ones essay coming from for ordinary custom essay writing services uk in to a refined AS WELL AS concise essay. you have quite possibly spent the considerable amount connected with day a lot more than your own academic assignment. your own next step can be in order to polish It to help perfection. This can be possible pertaining to you, like a writer, to be able to overlook the errors that you can have committed.

    ReplyDelete
  5. Frequent people demand special discounts and also other cheap business arrivals. It is because that they vacation on a day-to-day basis. Few air arrivals corporations consider these kind of people while many will not.discount travel

    ReplyDelete
  6. world-wide-web design deals from the location regarding designing a site AS WELL AS on the lengthy operate updating AS WELL AS maintaining. from the world wide web boom, every firm wants to have an on the internet footprint AND the website is The best way to showcase one's skills IN ADDITION TO business IN ADDITION TO kindle the curiosity regarding potential customers.CMS for web designers

    ReplyDelete
  7. The HTML reports can be shown utilizing diverse yield styles. HTML labels were initially intended to characterize the substance of a report. Falling web-designing Styles sheets characterize how HTML components are to be shown.

    ReplyDelete
  8. Primeau Productions is your current full-service online video media production company, throughout company intended for over 30 years. Primeau Productions owes its success immediately towards the results The idea achieves due to the clients. i are a results-oriented company, As established via MY PERSONAL published listing of long-term, repeat customers.keynote-speaker-demo-video-production

    ReplyDelete
  9. Great information about the css and it related create digital tickets . Now this time we need this type of info to get success. Once again thanks for the Css information.

    ReplyDelete
  10. The best solution is the one WebGL adopted: prevent sensitive data from entering the timing channel. hvac repair denver

    ReplyDelete
  11. Thank you for your post.Really looking forward to read more. Cool.
    Diwali wishes 2015

    ReplyDelete
  12. Thanks for sharing, this is a fantastic blog.Thanks Again. Much obliged.
    diwali sms images 2015

    ReplyDelete
  13. I am so grateful for your blog.Really thank you! Cool
    Prem ratan dhan payo torrent

    ReplyDelete
  14. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  15. I really like and appreciate your blog.Thanks Again. Really Cool.
    New year wishes 2016
    New year wishes

    ReplyDelete
  16. I appreciate you sharing this article.Thanks Again. Much obliged.
    New year images 2016
    New year pictures 2016

    ReplyDelete
  17. Really appreciate you sharing this blog.Really looking forward to read more. Much obliged.
    New year wishes 2016

    Happy new year wishes 2016

    ReplyDelete
  18. Thanks for the blog post.Really looking forward to read more. Will read on…
    Happy new year quotes

    New year quotes 2016

    ReplyDelete
  19. This is really great work. Thank you for sharing such a useful information here in the blog.
    Voodoo Spells

    ReplyDelete
  20. A great possibility for me and it was a superb knowledge to view this site. Very difficult to uncover these beneficial web page or web site. I have many devices and achieving proper picture of these worked well and energy continues to be seeing about this weblog. Often my own intend to make my personal site as well as my
    agario
    pacman
    plants vs zombies
    solitaire
    happy wheels
    car games

    ReplyDelete
  21. Crazy Bulk Australia 100% Safe and Legal Steroids

    Click Here To Avail Buy 2 Get 1 Free Discount Offer

    ReplyDelete
  22. Thanks for sharing the information. It is very useful for my future. keep sharing
    A good blog.
    Signature:
    i like play happy wheels games online and play games happy wheels demo full and game zombie tsunami , retrica apk , retrica download , happy wheels demo , agario

    ReplyDelete
  23. http://republicdayquotes2016.com
    http://republicdayquotes2016.com/happy-26th-january-republic-day-pictures/
    http://republicdayquotes2016.com/indian-flag-pictures-images-for-republic-day-2016/
    http://republicdayquotes2016.com/happy-republic-day-2016-sms-wishes/
    http://republicdayquotes2016.com/happy-republic-day-quotes-in-hindi/
    http://republicdayquotes2016.com/why-is-republic-day-celebrated-in-india-on-26th-january/
    http://republicdayquotes2016.com/happy-republic-day-2016-quotes-in-english/
    http://republicdayquotes2016.com/happy-republic-day-2016-speech-essay-paragraph-for-school-students/
    http://republicdayquotes2016.com/republic-day-2016-slogan-poster-sayings/
    http://republicdayquotes2016.com/happy-republic-day-2016-whatsapp-status-whatsapp-dp/
    http://republicdayquotes2016.com/famous-republic-day-images-quotes-26th-january-2016/
    Republic Day 2016 Slogan | Poster | Sayings

    Happy Republic Day 2016 Whatsapp Status & Whatsapp DP

    Famous Republic Day Images with Quotes on 26th January 2016

    Happy Republic Day 2016 Speech | Essay | Paragraph for School Students

    Happy Republic Day 2016 Quotes in English

    Happy 26th January Republic Day Pictures

    Indian Flag Pictures – Images for Republic Day 2016 (गणतंत्र दिवस)

    Happy Republic Day 2016 Sms Wishes

    Happy Republic Day 2016 Quotes in Hindi

    Why is Republic Day Celebrated in India on 26th January


    ReplyDelete
  24. i THINK THERE IS SOME grammatical mistakes mothers day 2016 quotes and some spelling mistakes too Fathers day 2016 quotes and check iphone 7 too Apple iPhone 7 and soon cbse result is going to live on the website CBSE RESULT 2016

    ReplyDelete
  25. I will take a few main sections to be included in my article. Hopefully you'll agree. Thank you. descargar facebook , baixar whatsapp , whatsapp messenger , mobogenie , mobogenie , baixar facebook , baixar facebook

    ReplyDelete
  26. Superb Post it really helpful for me ,And also can u please help me to fix my website design as well.

    freelancer singapore

    ReplyDelete
  27. It is a really nice and awesome post.....by reading this i understand that you are awesome... Thanks, Superb Post it really helpful for me ,And also can u please help me to fix my website design as well.

    If you wish to be able to learn more about how to optimize your website, then you should try to visit the site novage.com.sg - best web design company singapore

    ReplyDelete
  28. Thanks-a-mundo for the article post.Really thank you! Want more.
    CBSE Result 12th Class

    ReplyDelete
  29. Very good post.Really looking forward to read more. Want more
    Advance Happy Holi Wishes

    ReplyDelete
  30. I appreciate you sharing this blog.Really looking forward to read more. Will read on…
    Holi Pictures 2016 Greeting Cards

    ReplyDelete
  31. This is one awesome blog post.Really thank you! Really Great.
    CBSE 10th Result Nic.in

    ReplyDelete
  32. The content is great, and you’re an educated writer unlike most of the blogs.thanks for the post.

    Buying used dump trucks?

    ReplyDelete
  33. Wow !! It's great info. I really love this information but you can have more information regarding this subject on website.

    ReplyDelete
  34. It sits on the rack and you are out the cash. With utilized computer games, you can keep away from that.

    gamehere

    ReplyDelete
  35. a portion of the top utilized computer game frameworks and what the diversions are similar to with each

    http://snailbobx.com

    ReplyDelete
  36. Playstation 1, including Crash Bandicoot, an amusement in the style of Mario and Sonic, which can be a considerable measure of fun.

    gunbloodx

    ReplyDelete
  37. Nice and informative post. thanks to share with us.
    Latest Jobs

    ReplyDelete
  38. Free online web gaming had blasted for as far back as 10 years and now there is an expansive gathering

    game homepage

    ReplyDelete
  39. the gaming a huge number of the easygoing diversion players, web entryways, distributers and designers.

    gamehere

    ReplyDelete
  40. Regardless of the possibility that gifted diversion engineers are still in constrained supply contrasted with the entrances and distributers of best free program amusements

    playhere

    ReplyDelete
  41. I appreciated looking at your post.Wholesale Womens Latex Waist Training Corsets, Fajas

    Neon Waist Trainer China Manufacturer|Latexcorsets.com, Great quality fashion

    manufactured with quality materials.http://www.latexcorsets.com/

    ReplyDelete
  42. Keep publishing and I will definitely be back again soon. Many thanks and take care.Wholesale Vintage Pin Up Lingerie Burlesque Costumes Corsets, 1950s burlesque lingerie and costumes for pin up girls and performers.|Latexcorsets.com

    ReplyDelete
  43. rubber waist cincher wholesale http://www.latexcorsets.com/
    wholesale latex waist training corset http://www.latexcorsets.com/latex-waist-training-corsets-c-207.html
    cheap petticoats for women http://www.latexcorsets.com/petticoat-c-195.html
    peasant burlesque corset http://www.latexcorsets.com/burlesque-corsets-c-199.html

    ReplyDelete
  44. This comment has been removed by the author.

    ReplyDelete

  45. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  46. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  47. Happy Mothers Day Images 2016


    Check Out some latest and new Mothers day images in HD for wishing your mother and try to impress her. we have huge collection of Happy mothers day images 2016


    http://www.motherday2016.com/happy-mothers-day-images-2016/

    ReplyDelete

  48. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again.

    - quotes about love
    - panama papers

    ReplyDelete
  49. I truly believe that everything that we do and everyone that we meet is put in our path for a purpose. There are no accidents; we're all teachers - if we're willing to pay attention to the lessons we learn, trust our positive instincts and not be afraid to take risks or wait for some miracle to come knocking at our door.
    - Quotes about love
    - Fancam Kpop

    ReplyDelete
  50. this blog is really helpful. i found very interesting things here. i am going to read this blog daily and will refer it to some of my friends are blogger.
    www.mahresult.nic.in
    ssc result 2016 online
    box office collection of sultan

    ReplyDelete
  51. Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes

    Strike Force Heroes 2

    Strike Force Heroes 3

    Strike Force Heroes 4

    Here are the simple steps to add an email address to your Hotmail contacts
    Hotmail Login

    Hotmail Sign In

    Sign In To Hotmail

    Recover Hotmail Password

    Create Hotmail Account

    Thanks for sharing nice information with us.

    ReplyDelete
  52. Evans played his trump card – i.e., Castle’s multiyear production deal with Paramount – to lure Castle out of the director’s chair,Old School New Body review and into the highly remunerative but largely ceremonial position of producer for Rosemary’s Baby.

    old school new body f4x reviews (Various sources – most notably, the autobiographies of Robert Evans and Roman Polanski, and a documentary featuring commentary by both men and production designer Richard Sylbert
    Steve & Becky Old School New Body review -- indicate that all final decisions regarding budget, casting and locations were made by Evans, not Castle.) With that out of the way, the Paramount chief set his sights on Roman

    ReplyDelete

  53. I enjoyed over read your blog post. Your blog have nice information,
    I got good ideas from this amazing blog.
    I am always searching like this type blog post. I hope I will see again..
    Signature:
    soi cau lo chinh xac 100

    soi cau
    soi cau mb
    soi cau mien bac

    ReplyDelete
  54. This is very amazing to see such work over here. Slitherio | Agario | Happy Wheels | happy fathers day 2016 messages Carry on the discussions over night.

    ReplyDelete
  55. This post is more informative. GOing forward expecting more posts..
    Father's Day 2016

    Father's Day
    happy Fathers Day

    ReplyDelete
  56. Hi there! Someone in my Facebook group shared this website with us so I
    came to take a look. I'm definitely loving the information. I'm
    bookmarking and will be tweeting this to my followers!

    Outstanding blog and terrific design.

    Fathers Day Gift Ideas

    Fathers Day Gifts

    Fathers Day Quotes

    Happy Fathers Day Images

    ReplyDelete
  57. Hi there! Someone in my Facebook group shared this website with us so I
    came to take a look. I'm definitely loving the information. I'm
    bookmarking and will be tweeting this to my followers!

    Outstanding blog and terrific design.

    Fathers Day Gift Ideas

    Fathers Day Gifts

    Fathers Day Quotes for Wishes

    Happy Fathers Day Images

    ReplyDelete
  58. Hi there! Someone in my Facebook group shared this website with us so I
    came to take a look. I'm definitely loving the information. I'm
    bookmarking and will be tweeting this to my followers!

    Outstanding blog and terrific design.

    Fathers Day Gift Ideas

    Fathers Day Gifts 2016

    Fathers Day Quotes

    Happy Fathers Day Images for Dad

    ReplyDelete
  59. Hi there! Someone in my Facebook group shared this website with us so I
    came to take a look. I'm definitely loving the information. I'm
    bookmarking and will be tweeting this to my followers!

    Outstanding blog and terrific design.

    Cool Quotes

    ReplyDelete
  60. The war between humans, orcs and elves continues. Lead your race through a series of epic battles, using your crossbow to fend off foes and sending out units to destroy castles. Researching and upgrading wisely will be crucial to your success! There are 5 ages total and each one will bring you new units to train to fight in the war for you cause.
    earn to die game vip | earn to die play game | unfair mario | slitherio | tanh trouble | age of war 6
    The game controls are shown just under . Movement mechanisms primarily include acceleration and tilting controls.
    It consists of a total of 17 levels and the challenge you face in each level increases as you go up. The game basically has a red ball that has to be moved across the various obstacles in its path to the goal.
    tank trouble | age of war | age of war 6 | gold miner | tank trouble 3 | age of war

    ReplyDelete

  61. Pega is a Java-based BPM tool which is used to build enterprise applications. Among all the BPM tools in the market Pega is the leading and No-1 BPM tool according to market standards far

    beyond its competitors. Pega enables in creating and managing web-based applications with less effort and faster deadlines using Agile or Scrum methodology.

    Pega is a Java-based BPM tool which is used to build enterprise applications. Among all the BPM tools in the market Pega is the leading and No-1 BPM tool according to market standards far

    beyond its competitors. Pega enables in creating and managing web-based applications with less effort and faster deadlines using Agile or Scrum methodology.



    Pega Training |
    AWS Training |
    Informatica MDM Training |
    PlSQL Training |
    Qlikview Training |
    Teradata Training

    ReplyDelete
  62. تكييف شارب العربي لأدارة مبيعات تكييف شارب في مصر وصيانة تكييفات شارب العربي وخدمة عملاء موقع تكييف شارب العربي وجميع المعلومات الهامة عن تكييف شارب .
    أسعار تكييف شارب مقدمة من توكيل تكييف شارب المعتمد من شركة شارب العالمية تفضل زائرنا العزيز بالاطلاع علي اسعار تكييف شارب عام 2016 .

    ReplyDelete
  63. مرحبا بكم دائما على افضل موقع عربي يختص فقط في تقديم العاب بنات بنات ستايل جديدة وجميلة جدا يمكنكم اللعب والاستمتاع بها كما تريدون وايضا سوف تجدون فيه العاب باربي والعاب بنات ويمكنكم تلبيس فتيات جميلات جدا وانيقات
    كذلك وسوف تستمتعون كثيرا باللعب في العاب تلبيس بنات ستايل جديدة

    ReplyDelete
  64. Hotmail is an email account of Microsoft Corporation. Like Google's Gmail, it is full of features usually xuyen.Neu of an email you want to register an account please follow these basic steps:
    Hotmail login

    Hotmail review

    Sign in to hotmail

    Login to hotmail

    Recover hotmail password

    Tank Trouble is a very interesting flash game about tanks, about war and about destruction
    TANK TROUBLE | TANK TROUBLE 2

    One Penguin Takes it personally when he is surfing the web and stumbles upon a web site telling him that he cant fly, after that he sets his mind to research and practice flying until he can prove the world that he can..
    Slitherio | LEARN TO FLY | LEARN TO FLY 2

    Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes 4

    Strike Force Heroes

    ReplyDelete
  65. It is biggest Cycling event of this year. It is also known as Tour De France 2016. Our website have provided details like Tour De France 2016 Results Groups, teams and Tour De France Results 2016. We all know that Tour De France 2016 Stages are divided into 22 parts. We have explained each of them in our website. Stay tuned for more updates. US open 2016 Tennis is one of the biggest event of the us history. You can find US Tennis Open Results on our website for free. US Open 2016 will start soon at the eng od august month. Rio Olympics 2016 Mascots are great way to express feelings towards game lovers. You can easily find Rio Olympics 2016 Schedule on our website. You can also find Happy Birthday wishes. You can find Premier League information on our site. You can also find Premier League Table .

    ReplyDelete
  66. consider in case you're thinking about Wii Games Download and How To lead it through the Internet. clash of clans hack tool

    ReplyDelete
  67. Rio 2016 is a major international multi-sport event in the tradition of the Olympic Games due to take place in Rio de Janeiro, Brazil.
    rio 2016 theme song
    olympics 2016 opening ceremony live streaming
    rio olympics 2016 live telecast india

    ReplyDelete
  68. Grab the festival eid al adha 2016 dates and eid al adha details for free of cost on our website. grandparents day 2016 will be celebrated in most of countries. It is also known as happy grandparents day 2016 . Apart from this labor day weekend 2016 is also coming next month. You can chek details of labor day 2016

    Get the unique Premier League Fixture 2016 and Premier League Fixture 2017 for free of cost. You can also search it by keywords like Premier League Table, Premier League Table 2016 and Premier League Table 2017 done. Share it by using Premier League Standings , Premier League Standings 2016 and Premier League Standings 2017 , Feel free to get the us open tennis 2016 info, latest Premier League Fixture info.

    We have also shared with you Premier League Fixtures as well as Premier League Table Apart from that you can find out the us open 2016 winners and Rio Olympics 2016 Schedule ,

    ReplyDelete
  69. hi i am harshit web application developer and SEO executive in mathura live in new delhi i having a experience to develop a php based websites

    ReplyDelete