Slashdot Mirror
Sniffing Browser History Without Javascript
Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."
You can't tell what sites I've been to if it's Slashdotted!
The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html
Will it know if I've gone on Goatse?
I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?
Find free books.
then it means you've come from Slashdot.
.cum
They started handing out custom TLDs already?
Most people will never understand and basic exploits like this will always work against them. At what point is it the browser's (and app support staff) responsibility to protect the ignorant? The simple fix for this and many things similar is to not cache, don't keep a history, lock your browser down. If you're too stupid to do that... it's kind of your own fault.
Does a car manufacturer have a responsibility to make you drive safe? They make the car and if you're too stupid to learn how to use it properly you'll be weeded out.
Doesn't work on me - Firefox, with adblock plus, element hiding helper, and flashblock, running whatever the latest Ubuntu is.
... and maybe even nefarious, but you've got to admit: it's a neat hack (in the original sense of the word--i.e., clever)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Eg. IMG like opera..
You should only load remote images on demand.
Sounds like a no-brainer to me.
Yeah , I know must be new here..
Crap. What did the new CSS do with the "Post anonymously" option??
since noscript blocks iframes, if you configure it properly.
+1 Evil
It does not require an iframe. It's just that this way it's easier to hide any visual clues.
The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.
yacc
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.
From an exploit standpoint, no. From an editorial standpoint, yes.
Sig this!
tOM
Epitaph: At last! Root access!
Normally the browser won't load a CSS-defined external resource if it's not required, but in this case, for links it should load resources under :visited for any link, visited or not. This way this PoC would return visited for any random site, they really wouldn't get any useful data. However 1) it uses a bit more bandwidth fetching images that may not be used, although they are precached in the event the links do end up being clicked and 2) false positives on sites which use this for targeted ads etc might trigger said ads.
My idea for a fix for the JS version of the exploit (IIRC it's where you fetch the style information for a link, say, it's color, and have visited links colored differently from unvisited) would be to have any JS queries against CSS on links return the styling of the link if it WASN'T visited... regardless of whether it actually is or not. Shouldn't break any web apps unless someone uses it like a HTTP referer to see if you came from their site to the current page or something...
I'm letting it scan my browser now. So far the only thing it has found is Slashdot. It could maybe find sites that I've followed links from Slashdot to. But it won't find much because I run a separate browser instance, with its own (initially empty) browser history, cookies, etc, for each site I visit via by the means I have set up to start a new browser (command line script, and menu selection for the browser). And for those of you who are wanting to tell me "but Firefox just joins all startups into the same process and only gives you a new window". Well, I defeated that by dynamically creating a new home directory on the fly for each startup, populating it with a template set of files Firefox expects, setting the HOME environment variable to that path, and starting the Firefox process. So the scanning of my browser is limited to just what this one I use for Slashdot has visited recently.
now we need to go OSS in diesel cars
Comment removed based on user account deletion
Some browsers DO allow running a second instance.
Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The fix is dead-simple: the browser should load all "a:visited" images, regardless of whether or not it will display them.
I never, ever thought I'd write a post with "mod parent up" in the subject line but this is genius. Perfect solution to all these web-bug issues and really just another form of prefetching.
"But everyone should know everything." -markab
There are several firefox plugins which limit and reduce your history.
I don't think the NoScript fellows are specifically targeting anonymity, but rather simply choosing what actions (in a volatile world) can be executed.
There exist a world of many more precautions to take for those who are worried about keeping their privacy.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
For site that allowed user to post CSS content, and that's there is interest to steal the cookie, it could be done in the same way.
For example, xanga.com (cookie to steal your login info), or Forum/BBS site that allows poisting CSS.
The cookies will be sent along with the CSS background request.
Blogger/Blogspot is a good example how this should be handled...just put it in two different domains.
I can disable JavaScript, Java, cookies, and password memorization. That's great. Now, please let me disable the most useless feature of all: iframes.
Oh, wait... then web developers will inject 3rd party web code directly into the main document with AJAX, which is even worse.
That's the Slashdot Effect at work protecting your privacy.
now we need to go OSS in diesel cars
Indeed. the "no mod and comment" rule is perhaps one of the most ill-concieved rules I have seen. It just ensures the people moderating on a topic are the ones who arn't knowledgeable enough to comment on it (or vice versa). Unscrupulous people can just use sockpuppet accounts to moderate so it really only affects honest users who are likely the ones who will add value by commenting and moderating.
http://notanumber.net/
This is pretty sweet, albeit scary.
You know what, if you really feel you must repeat your username again as a sig, why not put it in the sig field so we can all filter that stupid crap out.
Well, hidden might well turn off the complete processing.
OTOH, yes, I think there are a number of ways to hide the links with CSS (foreground == background comes to mind).
yacc
Only visit really obscure por... dating sites.
paintball
Trolls are given mod points too.
Maybe one can use this site to their advantage. Obviously, the owners know something we know not - popularity of websites. If you can 'play' the browser at the user end, you can have a look into their database. See what they're searching for and how. It cuts both ways.
Religion is what happens when nature strikes and groupthink goes wrong.
Thats a interesting trick.
Doesnt actually require iframes, and can be used by advertisers to pin down your 'preferences' over several pages as they track you.
Hmm, so how does one go about turning off CSS processing in a browser?
putting the rule
a:visited {
background:none !important;
in userContent.css seems to stop this particular scan.
I have written bug reports which got no attention at all. For years I was laughed at in forums for describing this problem.
There are some tools, which don't get updated anymore, safecache and safehistory. Here are papers from 2006:
http://crypto.stanford.edu/sameorigin/
cb
like you can with IE, separate memory instance, share cookies/cache/history...
that way if one instance crashes, it doesn't take all of them down
i'm not discounting the usefulness of profiles,
but this is a feature practically every windows program has,
and firefox team won't put in out of spite (it would literally take 10 lines of code)
... why not the good old height="1px" width="1px" ?
Or for the CSS people, img.stealinurhistories:visited {height:1px!important; width:1px!important; url-leeching-method-of-preference-here}
That could probably defeat a few CSS overrides, could probably throw in some positioning, z-index, etc.
You could probably even go as far as chaining all the way through the DOM to increase the rules weight. (at least, i think this adds more weight to it, i never did look into it. Anyone?)
In fact, 0 might work, but i prefer to stay away from 0.
This is for FF 3.0. YMMV with other versions and other browsers.
Go to Preferences -> Advanced -> General. Under "Accessibility" check the option for "Warn me when web sites try to redirect or reload the page".
The attack relies on trying a lot of links ... but with the above setting FF warns on each attempt, with a warning across the top of the page saying "Firefox prevented this page from automatically redirecting to another page". So the attack could proceed if you sat there clicking the "approve" button constantly. But after the second or third warning, well, I hope you'd become suspicious.
This has been known for years.
It was also used in our group for one of those Myspace trackers until they got around to disallowing parameter-based images being set as a source. (and this was at least 4 years ago, if not that, then 5)
Not been bothered to figure ways around it since then really, group broke, rest is history.
Instead of using browser history, bookmark everything moderately interesting in your history and then disable it. You still get URL auto-completion, but there's no history so the standard history attacks won't work.
Of course, if there's a bookmark hack then you're hosed!
No, the simplest solution is to adopt a policy I took up in the late '90s when it first occurred to be that my history might be sniffed:
/dev/null, though I am aware that current browsers offer an option to clear it...
Delete it.
That's right. It's perfectly possible to live a fulfilled life without browser history, or cookies for that matter. In fact, I still have my cookies file symlinked to
this attack doesn't depend on a re-direct, it relies on loading images, not on redirects.
Since I'm using minefield (nightly Firefox build), it has a "private browsing mode" which, as expected, doesn't let the site do this. I find it very useful.
I keep a browser history to find visited pages faster, but that only works because it takes frecency into account. A binary visited/non-visited flag becomes asymptotically useless as history builds up over time. Even more so on shared computers.
As a quick fix, it shouldn't be too hard to write a userscript that either inserts hidden links for all a:visited styles or disables custom a:visited styles.
https://addons.mozilla.org/en-US/firefox/addon/1502 seems to protect against this
layout.css.visited_links_enabled = false
Agreed. And in my over-excitement of creating a counter-example, I forgot to acknowledge the cleverness of this solution.
What we need is caja, http://code.google.com/p/google-caja
or change the about:config setting called "layout.css.visited_links_enabled"
FYI, you can get forward delete on a Mac with only a backspace button by holding the "Function" button and hitting backspace.
Are we certain this isn't a scam to exploit slashdot traffic? I'm a proud purveyer of the occasional pornography, but that website claimed I visited hundreds of adult sites i've never even heard of.