timing_attacks

HTML 5 and related technologies bring a whole slew of new features to web browsers, some of which can be a threat to security and privacy. This paper describes a number of new timing attack techniques that can be used by a malicious web page to steal sensitive data from modern web browsers, breaking cross-origin restrictions.

The new HTML5 request AnimationFrame API can be used to time browser rendering operations and infer sensitive data based on timing data. Two techniques are demonstrated which use this API to exploit timing attacks against Chrome, Internet Explorer and Firefox in order to infer browsing history and read cross-origin data from other websites. The first technique allows the browser history to be sniffed by detecting redraw events. The second shows how SVG filters can be used to read pixel values from a web page. This allows pixels from cross-origin iframes to be read using an OCR-style technique to obtain sensitive data from websites.

Read the white paper

Explore More

What are the various steps in the pre-attack phase?

In the pre-attack phase, there are seven steps, which have been defined by the EC-Council, as follows: 1. Information gathering 2. Determining network range 3. Identifying active machines 4. Finding

WikiLeaks founder Julian Assange was refused bail by a British court on Tuesday after he was arrested over allegations of sex crimes in Sweden.

(Reuters) Assange, whose WikiLeaks website is at the center of a row over the release of secret U.S. diplomatic cables, was arrested under a European Arrest Warrant earlier on Tuesday

Kaspersky’s support website hacked!

Hard to digest, but true. The leading anti-virus website provider Kaspersky’s support website got hacked and details are published at this blog. Kasperksy admitted that it’s their fault and blamed