Saturday, December 3, 2011

Timing Attacks on CSS Shaders

CSS Shaders is a new feature folks from Adobe, Apple, and Opera have proposed to the W3C CSS-SVG Effects Task Force.  Rather than being limited to pre-canned effects, such as gradients and drop shadows, CSS Shaders would let web developers apply arbitrary OpenGL shaders to their content.  That makes for some really impressive demos.  Unfortunately, CSS Shaders has a security problem.

To understand the security problem with CSS Shaders, it's helpful to recall a recent security issue with WebGL.  Similar to CSS Shaders, WebGL lets developers use OpenGL shaders in their web applications.  Originally, WebGL let these shaders operate on arbitrary textures, including textures fetched from other origins.  Unfortunately, this design was vulnerable to a timing attack because the runtime of OpenGL shaders can depend on their inputs.

Using the shader code below, James Forshaw built a compelling proof-of-concept attack that extracted pixel values from a cross-origin image using WebGL:
for (int i = 0; i <= 1024; i += 1) {
  // Exit loop early depending on pixel brightness
  currCol.r -= 1.0;
  if (currCol.r <= 0.0) {
    currCol.r = 0.0;
    break;
  }
}
Timing attacks are difficult to mitigate because once the sensitive data is present in the timing channel it's very difficult to remove.  Using techniques like bucketing, we can limit the number of bits an attacker can extract per second, but, given enough time, the attacker can still steal the sensitive data.  The best solution is the one WebGL adopted: prevent sensitive data from entering the timing channel.  WebGL accomplished this by requiring cross-origin textures to be authorized via Cross-Origin Resource Sharing.

There's a direct application of this attack to CSS Shaders.  Because web sites are allowed to display content that they are not allowed to read, an attacker can use a Forshaw-style CSS shader read confidential information via the timing channel.  For example, a web site could use CSS shaders to extract your identity from an embedded Facebook Like button.  More subtly, a web site could extract your browsing history bypassing David Baron's defense against history sniffing.

The authors of the CSS Shaders proposal are aware of these issues.  In the Security Considerations section of their proposal, they write:
However, it seems difficult to mount such an attack with CSS shaders because the means to measure the time taken by a cross-domain shader are limited.
Now, I don't have a proof-of-concept attack, but this claim is fairly dubious.  The history of timing attacks, including other web timing attacks, teaches us that even subtle leaks in the timing channel can lead to practical attacks.  Given that we've seen practical applications of the WebGL version of this attack, it seems quite likely CSS Shaders are vulnerable to timing attacks.

Specifically, there are a number of mechanisms for timing rendering.  For example, MozBeforePaint and MozAfterPaint provide a mechanism for measuring paint times directly.  Also, the behavior of requestAnimationFrame contains information about rendering times.

Without a proof-of-concept attack we cannot be completely certain that these attacks on CSS Shaders are practical, but waiting for proof-of-concept attacks before addressing security concerns isn't a path that leads to security.

800 comments:

  1. I've also been wondering whether SVG filters could be used for a similar attack. SVG filters aren't programmable like shaders are, so you couldn't directly affect the timing. However it might be possible to make a filter that is quicker for a certain pixel values due to various optimisations in the filter algorithms (e.g. a black pixel might be very quick to process because the output would always be zero for a particular filter). Or you could find a combination of filters that hits some edge case that takes particularly long to process for some pixel values (maybe involving alpha or something)

    ReplyDelete
  2. Yeah, Dean Jackson has suggested that something like that might be possible. It definitely sounds worth experimenting with.

    ReplyDelete
  3. Parallel to this you can plan for the layout's response when the window expands. "Abu Dhabi Website Design" It will then include one or two sidebars and several other elements.

    ReplyDelete
  4. a essay editor will transform ones essay coming from for ordinary custom essay writing services uk in to a refined AS WELL AS concise essay. you have quite possibly spent the considerable amount connected with day a lot more than your own academic assignment. your own next step can be in order to polish It to help perfection. This can be possible pertaining to you, like a writer, to be able to overlook the errors that you can have committed.

    ReplyDelete
  5. Frequent people demand special discounts and also other cheap business arrivals. It is because that they vacation on a day-to-day basis. Few air arrivals corporations consider these kind of people while many will not.discount travel

    ReplyDelete
  6. world-wide-web design deals from the location regarding designing a site AS WELL AS on the lengthy operate updating AS WELL AS maintaining. from the world wide web boom, every firm wants to have an on the internet footprint AND the website is The best way to showcase one's skills IN ADDITION TO business IN ADDITION TO kindle the curiosity regarding potential customers.CMS for web designers

    ReplyDelete
  7. The HTML reports can be shown utilizing diverse yield styles. HTML labels were initially intended to characterize the substance of a report. Falling web-designing Styles sheets characterize how HTML components are to be shown.

    ReplyDelete
  8. Primeau Productions is your current full-service online video media production company, throughout company intended for over 30 years. Primeau Productions owes its success immediately towards the results The idea achieves due to the clients. i are a results-oriented company, As established via MY PERSONAL published listing of long-term, repeat customers.keynote-speaker-demo-video-production

    ReplyDelete
  9. Great information about the css and it related create digital tickets . Now this time we need this type of info to get success. Once again thanks for the Css information.

    ReplyDelete
  10. Thanks for sharing such a great article and it's helpful for everyone. Great Post! Hyderabad Online Florist

    ReplyDelete
  11. The best solution is the one WebGL adopted: prevent sensitive data from entering the timing channel. hvac repair denver

    ReplyDelete
  12. Thank you for your post.Really looking forward to read more. Cool.
    Diwali wishes 2015

    ReplyDelete
  13. Thanks for sharing, this is a fantastic blog.Thanks Again. Much obliged.
    diwali sms images 2015

    ReplyDelete
  14. I am so grateful for your blog.Really thank you! Cool
    Prem ratan dhan payo torrent

    ReplyDelete
  15. Really impressive post. I read it whole and going to share it with my social circules. I enjoyed your article and planning to rewrite it on my own blog.
    mahjong |geometry dash | kizi | hulk|agario | minecraft|halloween | pacman| | sniper games | games

    ReplyDelete
  16. This is a great post ! it was very informative. I look forward in reading more of your work. Also, I made sure to bookmark your website so I can come back later. I enjoyed every moment of reading it.
    baju batik modern baju batik baju batik wanita batik pekalongan batik couple batik online batik modern gamis batik

    ReplyDelete
  17. I really like and appreciate your blog.Thanks Again. Really Cool.
    New year wishes 2016
    New year wishes

    ReplyDelete
  18. I appreciate you sharing this article.Thanks Again. Much obliged.
    New year images 2016
    New year pictures 2016

    ReplyDelete
  19. Really appreciate you sharing this blog.Really looking forward to read more. Much obliged.
    New year wishes 2016

    Happy new year wishes 2016

    ReplyDelete
  20. Thanks for the blog post.Really looking forward to read more. Will read on…
    Happy new year quotes

    New year quotes 2016

    ReplyDelete
  21. This is really great work. Thank you for sharing such a useful information here in the blog.
    Voodoo Spells

    ReplyDelete
  22. A great possibility for me and it was a superb knowledge to view this site. Very difficult to uncover these beneficial web page or web site. I have many devices and achieving proper picture of these worked well and energy continues to be seeing about this weblog. Often my own intend to make my personal site as well as my
    agario
    pacman
    plants vs zombies
    solitaire
    happy wheels
    car games

    ReplyDelete
  23. Crazy Bulk Australia 100% Safe and Legal Steroids

    Click Here To Avail Buy 2 Get 1 Free Discount Offer

    ReplyDelete
  24. Thanks for sharing the information. It is very useful for my future. keep sharing
    A good blog.
    Signature:
    i like play happy wheels games online and play games happy wheels demo full and game zombie tsunami , retrica apk , retrica download , happy wheels demo , agario

    ReplyDelete
  25. http://republicdayquotes2016.com
    http://republicdayquotes2016.com/happy-26th-january-republic-day-pictures/
    http://republicdayquotes2016.com/indian-flag-pictures-images-for-republic-day-2016/
    http://republicdayquotes2016.com/happy-republic-day-2016-sms-wishes/
    http://republicdayquotes2016.com/happy-republic-day-quotes-in-hindi/
    http://republicdayquotes2016.com/why-is-republic-day-celebrated-in-india-on-26th-january/
    http://republicdayquotes2016.com/happy-republic-day-2016-quotes-in-english/
    http://republicdayquotes2016.com/happy-republic-day-2016-speech-essay-paragraph-for-school-students/
    http://republicdayquotes2016.com/republic-day-2016-slogan-poster-sayings/
    http://republicdayquotes2016.com/happy-republic-day-2016-whatsapp-status-whatsapp-dp/
    http://republicdayquotes2016.com/famous-republic-day-images-quotes-26th-january-2016/
    Republic Day 2016 Slogan | Poster | Sayings

    Happy Republic Day 2016 Whatsapp Status & Whatsapp DP

    Famous Republic Day Images with Quotes on 26th January 2016

    Happy Republic Day 2016 Speech | Essay | Paragraph for School Students

    Happy Republic Day 2016 Quotes in English

    Happy 26th January Republic Day Pictures

    Indian Flag Pictures – Images for Republic Day 2016 (गणतंत्र दिवस)

    Happy Republic Day 2016 Sms Wishes

    Happy Republic Day 2016 Quotes in Hindi

    Why is Republic Day Celebrated in India on 26th January


    ReplyDelete
  26. i THINK THERE IS SOME grammatical mistakes mothers day 2016 quotes and some spelling mistakes too Fathers day 2016 quotes and check iphone 7 too Apple iPhone 7 and soon cbse result is going to live on the website CBSE RESULT 2016

    ReplyDelete
  27. I will take a few main sections to be included in my article. Hopefully you'll agree. Thank you. descargar facebook , baixar whatsapp , whatsapp messenger , mobogenie , mobogenie , baixar facebook , baixar facebook

    ReplyDelete
  28. Superb Post it really helpful for me ,And also can u please help me to fix my website design as well.

    freelancer singapore

    ReplyDelete
  29. It is a really nice and awesome post.....by reading this i understand that you are awesome... Thanks, Superb Post it really helpful for me ,And also can u please help me to fix my website design as well.

    If you wish to be able to learn more about how to optimize your website, then you should try to visit the site novage.com.sg - best web design company singapore

    ReplyDelete
  30. Thanks-a-mundo for the article post.Really thank you! Want more.
    CBSE Result 12th Class

    ReplyDelete
  31. Very good post.Really looking forward to read more. Want more
    Advance Happy Holi Wishes

    ReplyDelete
  32. I appreciate you sharing this blog.Really looking forward to read more. Will read on…
    Holi Pictures 2016 Greeting Cards

    ReplyDelete
  33. This is one awesome blog post.Really thank you! Really Great.
    CBSE 10th Result Nic.in

    ReplyDelete
  34. The content is great, and you’re an educated writer unlike most of the blogs.thanks for the post.

    Buying used dump trucks?

    ReplyDelete
  35. Wow !! It's great info. I really love this information but you can have more information regarding this subject on website.

    ReplyDelete
  36. Have you ever met someone who liked the similar readings that you read? Its amazing to read inspirational quotes or love quotes for her to get better in life.

    ReplyDelete
  37. Posts shared useful information and meaningful life, I'm glad to be reading this article and hope to soon learn the next article. thank you
    Signature:
    Download retrica online includes more than eighty different filters with many different styles and include retrica indir , and zombie tsunami is the ideal game for anyone who loves the running game genre and happy wheels , agario , happywheels , agar ,

    ReplyDelete
  38. It sits on the rack and you are out the cash. With utilized computer games, you can keep away from that.

    gamehere

    ReplyDelete
  39. a portion of the top utilized computer game frameworks and what the diversions are similar to with each

    http://snailbobx.com

    ReplyDelete
  40. Playstation 1, including Crash Bandicoot, an amusement in the style of Mario and Sonic, which can be a considerable measure of fun.

    gunbloodx

    ReplyDelete
  41. Nice and informative post. thanks to share with us.
    Latest Jobs

    ReplyDelete
  42. Free online web gaming had blasted for as far back as 10 years and now there is an expansive gathering

    game homepage

    ReplyDelete
  43. the gaming a huge number of the easygoing diversion players, web entryways, distributers and designers.

    gamehere

    ReplyDelete
  44. Regardless of the possibility that gifted diversion engineers are still in constrained supply contrasted with the entrances and distributers of best free program amusements

    playhere

    ReplyDelete
  45. I appreciated looking at your post.Wholesale Womens Latex Waist Training Corsets, Fajas

    Neon Waist Trainer China Manufacturer|Latexcorsets.com, Great quality fashion

    manufactured with quality materials.http://www.latexcorsets.com/

    ReplyDelete
  46. Keep publishing and I will definitely be back again soon. Many thanks and take care.Wholesale Vintage Pin Up Lingerie Burlesque Costumes Corsets, 1950s burlesque lingerie and costumes for pin up girls and performers.|Latexcorsets.com

    ReplyDelete
  47. rubber waist cincher wholesale http://www.latexcorsets.com/
    wholesale latex waist training corset http://www.latexcorsets.com/latex-waist-training-corsets-c-207.html
    cheap petticoats for women http://www.latexcorsets.com/petticoat-c-195.html
    peasant burlesque corset http://www.latexcorsets.com/burlesque-corsets-c-199.html

    ReplyDelete
  48. Thank you for your blog.Thanks Again. Will read on…

    - Mortal Kombat XL
    - Atari Breakout
    - Dragon Ball Z Games

    ReplyDelete
  49. This comment has been removed by the author.

    ReplyDelete

  50. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  51. check out..! Here you get the Sp Flash Tools or Sp Flash Tools Links For Download

    Sp Flash Tools OR Sp Flash Tool Links for Download

    http://www.spflashtooldownload.com/

    ReplyDelete
  52. Happy Mothers Day Images 2016


    Check Out some latest and new Mothers day images in HD for wishing your mother and try to impress her. we have huge collection of Happy mothers day images 2016


    http://www.motherday2016.com/happy-mothers-day-images-2016/

    ReplyDelete

  53. I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again.

    - quotes about love
    - panama papers

    ReplyDelete
  54. I truly believe that everything that we do and everyone that we meet is put in our path for a purpose. There are no accidents; we're all teachers - if we're willing to pay attention to the lessons we learn, trust our positive instincts and not be afraid to take risks or wait for some miracle to come knocking at our door.
    - Quotes about love
    - Fancam Kpop

    ReplyDelete
  55. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    earn to die
    Hi! I’ve been reading your blog for a while now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    tank trouble
    tank trouble

    earn to die 1

    earn to die 2

    earn to die 3

    tank trouble 4
    tank trouble 3
    tank trouble 2

    ReplyDelete
  56. Thanks for the best blog.it was very useful for me.keep sharing such idea
    s in the future as well.this was actually what i was looking for,and i
    am glad to came here
    you keep up the fantastic work!my weblog
    age of war
    Hi! I’ve been reading your blog for a while now and finally got the
    happy wheels

    tank trouble 3

    ReplyDelete
  57. this blog is really helpful. i found very interesting things here. i am going to read this blog daily and will refer it to some of my friends are blogger.
    www.mahresult.nic.in
    ssc result 2016 online
    box office collection of sultan

    ReplyDelete
  58. Happy Mothers day Images 2016 Happy mothers day 2016 HD Images Happy Mothers day Wallpapers Happy mothers day Pics 2016 Happy Mothers day Pictures Happy mothers day Cards Happy Mothers day gifts ideas Happy Mothers day craft Ideas Happy Mothers day 2016 Free images download Happy Mothers day in heaven images Happy Mothers day Funny Images Happy Mothers day 2016 Love Quotes
    www.happymothersday2016images.com

    Happy Mothers Day Images Facebook


    Top 10 Easy Diy Mother’s Day 2016 Gifts Ideas

    Happy Mothers Day 2016 Cards

    Happy Mothers Day Images Australia

    Happy Mothers Day Images Arabic

    Happy Mothers Day Images Pinterest

    Happy Mothers Day Images Whatsapp

    Happy Mothers Day Poems

    Happy Mothers Day Gifts for mom

    Happy Mothers Day Messages


    Happy Mothers Day Status for facebook

    ReplyDelete
  59. Strike Force Heroes is a new game action-packed shooter from the creators of Raze; with 3 game modes, 15 campaign missions and over 65 weapons.
    Strike Force Heroes

    Strike Force Heroes 2

    Strike Force Heroes 3

    Strike Force Heroes 4

    Here are the simple steps to add an email address to your Hotmail contacts
    Hotmail Login

    Hotmail Sign In

    Sign In To Hotmail

    Recover Hotmail Password

    Create Hotmail Account

    Thanks for sharing nice information with us.

    ReplyDelete
  60. Thanks for the best blog.it was very useful for me.keep sharing such ideas in the future as well.this was actually what i was looking for,and i am glad to came here!
    Tank trouble
    Hi! I’ve been reading your blog for a while
    now and finally got the courage to go ahead and give youu a shout out from Austin Texas! Just wanted to tell you keep up the fantastic work!my weblog:
    Earn to die

    Barron Games

    Subble shooter

    Tank trouble

    ReplyDelete
  61. Let’s keep out sites for your child! click:
    brain games | puzzle games | tetris | happy wheels | agario | abcya | fnaf 4 | super mario games
    To play for free!

    ReplyDelete
  62. Yes i am totally agreed with this article and i just want say that this article is very nice and very informative article.I will make sure to be reading your blog more. You made a good point but I can't help but wonder, what about the other side? !!!!!!Thanks
    Tata Sky Customer Care Number
    GTPL Customer Care Number
    Dish TV Customer Care Number

    ReplyDelete
  63. Tennis elbow, inflammation of the elbow joint, is usually caused by overstrain of the muscles in the wrist and fingers.
    Daily Trending Guide It is very painful and limits greatly the use of the hand as the pain radiates from the elbow to the outer side of the forearm.
    You can use acupressure to improve the flexibility of the arm. According to Traditional Chinese Medicine most of the acupressure points which relieve tennis elbow are located in the Large Intestine meridian. So a better bowel function is a side effect of this treatment.

    ReplyDelete
  64. Evans played his trump card – i.e., Castle’s multiyear production deal with Paramount – to lure Castle out of the director’s chair,Old School New Body review and into the highly remunerative but largely ceremonial position of producer for Rosemary’s Baby.

    old school new body f4x reviews (Various sources – most notably, the autobiographies of Robert Evans and Roman Polanski, and a documentary featuring commentary by both men and production designer Richard Sylbert
    Steve & Becky Old School New Body review -- indicate that all final decisions regarding budget, casting and locations were made by Evans, not Castle.) With that out of the way, the Paramount chief set his sights on Roman

    ReplyDelete

  65. I enjoyed over read your blog post. Your blog have nice information,
    I got good ideas from this amazing blog.
    I am always searching like this type blog post. I hope I will see again..
    Signature:
    soi cau lo chinh xac 100

    soi cau
    soi cau mb
    soi cau mien bac

    ReplyDelete
  66. This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
    obat aborsi
    cara menggugurkan kandungan
    obat telat datang bulan
    obat penggugur kandungan

    ReplyDelete
  67. This is very amazing to see such work over here. Slitherio | Agario | Happy Wheels | happy fathers day 2016 messages Carry on the discussions over night.

    ReplyDelete
  68. I am very sympathetic to your viewpoint. It is very deep and meaningful.
    - slither.io
    - wings.io
    - vanar.io
    - lazerdrive.io
    - diep.io

    ReplyDelete
  69. This post is more informative. GOing forward expecting more posts..
    Father's Day 2016

    Father's Day
    happy Fathers Day

    ReplyDelete
  70. Hi there! Someone in my Facebook group shared this website with us so I
    came to take a look. I'm definitely loving the information. I'm
    bookmarking and will be tweeting this to my followers!

    Outstanding blog and terrific design.

    Fathers Day Gift Ideas

    Fathers Day Gifts

    Fathers Day Quotes

    Happy Fathers Day Images

    ReplyDelete