Slashdot Mirror
Sniffing Browser History Without Javascript
Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."
You can't tell what sites I've been to if it's Slashdotted!
The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html
I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?
Find free books.
its easy to tell, with that nickname of yours.. :)
then it means you've come from Slashdot.
Most people will never understand and basic exploits like this will always work against them. At what point is it the browser's (and app support staff) responsibility to protect the ignorant? The simple fix for this and many things similar is to not cache, don't keep a history, lock your browser down. If you're too stupid to do that... it's kind of your own fault.
Does a car manufacturer have a responsibility to make you drive safe? They make the car and if you're too stupid to learn how to use it properly you'll be weeded out.
Doesn't work on me - Firefox, with adblock plus, element hiding helper, and flashblock, running whatever the latest Ubuntu is.
... and maybe even nefarious, but you've got to admit: it's a neat hack (in the original sense of the word--i.e., clever)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Eg. IMG like opera..
You should only load remote images on demand.
Sounds like a no-brainer to me.
Yeah , I know must be new here..
Crap. What did the new CSS do with the "Post anonymously" option??
since noscript blocks iframes, if you configure it properly.
+1 Evil
It does not require an iframe. It's just that this way it's easier to hide any visual clues.
The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.
yacc
From an exploit standpoint, no. From an editorial standpoint, yes.
Sig this!
tOM
Epitaph: At last! Root access!
Normally the browser won't load a CSS-defined external resource if it's not required, but in this case, for links it should load resources under :visited for any link, visited or not. This way this PoC would return visited for any random site, they really wouldn't get any useful data. However 1) it uses a bit more bandwidth fetching images that may not be used, although they are precached in the event the links do end up being clicked and 2) false positives on sites which use this for targeted ads etc might trigger said ads.
My idea for a fix for the JS version of the exploit (IIRC it's where you fetch the style information for a link, say, it's color, and have visited links colored differently from unvisited) would be to have any JS queries against CSS on links return the styling of the link if it WASN'T visited... regardless of whether it actually is or not. Shouldn't break any web apps unless someone uses it like a HTTP referer to see if you came from their site to the current page or something...
I'm letting it scan my browser now. So far the only thing it has found is Slashdot. It could maybe find sites that I've followed links from Slashdot to. But it won't find much because I run a separate browser instance, with its own (initially empty) browser history, cookies, etc, for each site I visit via by the means I have set up to start a new browser (command line script, and menu selection for the browser). And for those of you who are wanting to tell me "but Firefox just joins all startups into the same process and only gives you a new window". Well, I defeated that by dynamically creating a new home directory on the fly for each startup, populating it with a template set of files Firefox expects, setting the HOME environment variable to that path, and starting the Firefox process. So the scanning of my browser is limited to just what this one I use for Slashdot has visited recently.
now we need to go OSS in diesel cars
Comment removed based on user account deletion
Some browsers DO allow running a second instance.
Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The fix is dead-simple: the browser should load all "a:visited" images, regardless of whether or not it will display them.
I never, ever thought I'd write a post with "mod parent up" in the subject line but this is genius. Perfect solution to all these web-bug issues and really just another form of prefetching.
"But everyone should know everything." -markab
There are several firefox plugins which limit and reduce your history.
I don't think the NoScript fellows are specifically targeting anonymity, but rather simply choosing what actions (in a volatile world) can be executed.
There exist a world of many more precautions to take for those who are worried about keeping their privacy.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
For site that allowed user to post CSS content, and that's there is interest to steal the cookie, it could be done in the same way.
For example, xanga.com (cookie to steal your login info), or Forum/BBS site that allows poisting CSS.
The cookies will be sent along with the CSS background request.
Blogger/Blogspot is a good example how this should be handled...just put it in two different domains.
I can disable JavaScript, Java, cookies, and password memorization. That's great. Now, please let me disable the most useless feature of all: iframes.
Oh, wait... then web developers will inject 3rd party web code directly into the main document with AJAX, which is even worse.
That's the Slashdot Effect at work protecting your privacy.
now we need to go OSS in diesel cars
Indeed. the "no mod and comment" rule is perhaps one of the most ill-concieved rules I have seen. It just ensures the people moderating on a topic are the ones who arn't knowledgeable enough to comment on it (or vice versa). Unscrupulous people can just use sockpuppet accounts to moderate so it really only affects honest users who are likely the ones who will add value by commenting and moderating.
http://notanumber.net/
This is pretty sweet, albeit scary.
Well, hidden might well turn off the complete processing.
OTOH, yes, I think there are a number of ways to hide the links with CSS (foreground == background comes to mind).
yacc
Only visit really obscure por... dating sites.
paintball
Trolls are given mod points too.
Maybe one can use this site to their advantage. Obviously, the owners know something we know not - popularity of websites. If you can 'play' the browser at the user end, you can have a look into their database. See what they're searching for and how. It cuts both ways.
Religion is what happens when nature strikes and groupthink goes wrong.
Thats a interesting trick.
Doesnt actually require iframes, and can be used by advertisers to pin down your 'preferences' over several pages as they track you.
Hmm, so how does one go about turning off CSS processing in a browser?
putting the rule
a:visited {
background:none !important;
in userContent.css seems to stop this particular scan.
I have written bug reports which got no attention at all. For years I was laughed at in forums for describing this problem.
There are some tools, which don't get updated anymore, safecache and safehistory. Here are papers from 2006:
http://crypto.stanford.edu/sameorigin/
cb
This is for FF 3.0. YMMV with other versions and other browsers.
Go to Preferences -> Advanced -> General. Under "Accessibility" check the option for "Warn me when web sites try to redirect or reload the page".
The attack relies on trying a lot of links ... but with the above setting FF warns on each attempt, with a warning across the top of the page saying "Firefox prevented this page from automatically redirecting to another page". So the attack could proceed if you sat there clicking the "approve" button constantly. But after the second or third warning, well, I hope you'd become suspicious.
The parent post is marked informative? Informative like it is easy to tell who is a terrorist by the length of their beard?
No, the simplest solution is to adopt a policy I took up in the late '90s when it first occurred to be that my history might be sniffed:
/dev/null, though I am aware that current browsers offer an option to clear it...
Delete it.
That's right. It's perfectly possible to live a fulfilled life without browser history, or cookies for that matter. In fact, I still have my cookies file symlinked to
Since I'm using minefield (nightly Firefox build), it has a "private browsing mode" which, as expected, doesn't let the site do this. I find it very useful.
layout.css.visited_links_enabled = false
Agreed. And in my over-excitement of creating a counter-example, I forgot to acknowledge the cleverness of this solution.
What we need is caja, http://code.google.com/p/google-caja
Informative like it is easy to tell who is a terrorist by the length of their beard?
Hey, these screening techniques are supposed to be a state secret. If the terrorists go and shave of their beards bow we won't have a clue who they are and it will all be your fault.
or change the about:config setting called "layout.css.visited_links_enabled"
Are we certain this isn't a scam to exploit slashdot traffic? I'm a proud purveyer of the occasional pornography, but that website claimed I visited hundreds of adult sites i've never even heard of.