Slashdot Mirror
New Attack Steals SSNs, E-mail Addresses, and More From HTTPS Pages (arstechnica.com)
Security researchers at KU Leuven have discovered an attack technique, dubbed HEIST (HTTP Encrypted Information can be Stolen Through TCP-Windows), which can exploit an encrypted website using only a JavaScript file hidden in a maliciously crafted ad or page. ArsTechnica reports: Once attackers know the size of an encrypted response, they are free to use one of two previously devised exploits to ferret out the plaintext contained inside it. Both the BREACH and the CRIME exploits are able to decrypt payloads by manipulating the file compression that sites use to make pages load more quickly. HEIST will be demonstrated for the first time on Wednesday at the Black Hat security conference in Las Vegas. "HEIST makes a number of attacks much easier to execute," Tom Van Goethem, one of the researchers who devised the technique, told Ars. "Before, the attacker needed to be in a Man-in-the-Middle position to perform attacks such as CRIME and BREACH. Now, by simply visiting a website owned by a malicious party, you are placing your online security at risk." Using HEIST in combination with BREACH allows attackers to pluck out and decrypt e-mail addresses, social security numbers, and other small pieces of data included in an encrypted response. BREACH achieves this feat by including intelligent guesses -- say, @gmail.com, in the case of an e-mail address -- in an HTTPS request that gets echoed in the response. Because the compression used by just about every website works by eliminating repetitions of text strings, correct guesses result in no appreciable increase in data size while incorrect guesses cause the response to grow larger.
Keep getting more stupid by the hour
using only a JavaScript file hidden in a maliciously crafted ad or page
So we learn for the 1940390155th time that if you let a remote site run arbitrary scripts on your machine, that remote site might do things that are not in your best interest. Surprise surprise.
Look: we get a constant stream of these things, at least one or two per week, literally for over 10 years. They're all the same. "Run javascript, get pwned". If you care AT ALL about security, you need to block javascript by default and white-list a few sites you care about, like your bank.
If you are still running javascript by default, in 2016, that's on you. You've had over a decade to learn your lesson. This is like someone walking through the worst part of town at 3am flashing jewels and expensive watches. Then they get mugged. Is it the muggers fault? Yeah, of course it is. But the person doing this is still a bloody idiot, especially after it happens for the 10th time, and then the 20th, and the 50th, and the 100th. Eventually, they need to learn from experience.
Whitelist selected javascript, and disable everything else. It's time. It was a bad idea just like ActiveX was. The internet is not your friend. Random domains are not trustworthy. Stop letting them run code in your browser. Ignorance stops being a reasonable excuse after endless repetitions of "See this incredible new exploit(*)! (*) that requires you let the attacker run code on your computer."
I will continue to play my drums and keep my modem unplugged. Go ahead, try hacking me!
Security researchers at KU Leuven have discovered an security technique, dubbed HEIST, which can uncover terrorist plans, child pornography, neckbeard styling tips, and more from HTTPS pages!
... but the intro made me afraid to click the link.
correct guesses result in no appreciable increase in data size while incorrect guesses cause the response to grow larger.
So they still have to brute-force your SSN.
Slashdots runnin' another story on how 4 year old exploits are still unaccountably dangerous. And this time theres another wild and terrifying exploit called HEIST that, while entirely incapable of decrypting my traffic or interfering with my session, can determine what webserver im using so long as my connection uses http2. This exploit is the scariest thing since we started assigning arbitrary bullshit names to common vulnerabilities to gin up clickthrough revenue on krebs.
Good people go to bed earlier.
Yet another reason to never, NEVER turn off AdBlock, NoScript, Ghostery etc.
Advertisers and site operators, I don't CARE about your precious earnings if they come at a threat to my property.
-=This sig has nothing to do with my comment. Move along now=-
If marketing folks fail to properly package and brand an exploit, is it still a threat?
Once again proven that browsing the web is like going to a diner party in a world where the handshake has been replaced with unprotected anal sex.
Sure, many people you meet may be offended when you insist on a condom (plugins like requestpolicy, and noscript) and say its some right of theirs to not let you sit at their table because of it, or rant on about how they need to get paid....
but at the end of the day.... its basic security. Loading and running code from random third party sites is not safe. It doesn't matter if its inside a restricted environment, its a risk. Its a risk website owners are in the habbit of irresponsibly magnifying for all of their viewers without a second thought
You should protect yourself. Wear condoms unless you really know your partner. Get some here:
https://requestpolicycontinued...
https://noscript.net/
If you have a browser other than firefox, you will need something else, I don't know what they are but, bottom line...protect yourself.
"I opened my eyes, and everything went dark again"
I'm not a fan of that article summary.
New summary:
It is the same as CRIME, but we're using your browser's performance timing JS API as the man-in-the-middle.
A review:
Stick sensitive info into compressed stuff, and you make that sensitive info less private. If the encryption is zlib-like, then the attacker can guess the information quite quickly-- a good compressor compresses substrings, not just the whole thing.
That means that if you have a SSN in there, the attacker can guess some substrings of your SSN, and the response won't be much bigger.
Guesses that don't share substrings with your SSN will be larger-- the attacker can reject those as bad guesses and not try those substrings again.
With HTTP2's HPACK compressor (only used for info in the headers), this side-channel is eliminated-- only an exact guess of the data will allow this to happen.This is completely unrelated, however, to someone using entity-body compression with HTTP2. If you mix sensitive data with everything else in the compressed-entity body... side channel attacks galore!
A mitigation: Don't put the sensitive data in the same resource as the non-sensitive data, and then don't compress the sensitive data.
HTTP2 makes this cheaper. If sites do this, then these attacks simply do not work any better than the brute-force guessing would.
Ensuring that this happens (no sensitive data compressed) isn't necessarily the most easy thing...
Another obvious one is disable the timing API for 3rd party stuff. This is not as effective theoretically, but it is way easier to deploy and makes these kinds of attacks require an external 3rd party.
... the most noteworthy thing is the craftily cute name.
The takeaway we all learned many many years ago compression can be used as a side channel attack and therefore should probably never be used in conjunction with any stream containing sensitive data.
There is no need to invent different names based on where that compression occurs (CRIME, BREACH...etc.) or to assign even more aliases (HEIST) to the same damn thing. Wow you found a new set of metrics to enhance a side channel we all already knew about... so what?
This is one of the things I always hated about Defcon at least in the early days there were all kinds of talks about different ways to exploit this and that when everyone knew they weren't secure in the first place... like the old joke about someone discovering you can mount an unencrypted drive on another operating system and access all your files without knowing the password!!
It often boiled down to nothing more than implementing what everyone understood was possible anyway. Not very useful in my opinion.
At this point in the game anyone with important information to protect still vulnerable to compression attacks should probably do everyone a favor and look for a new line of work. There really isn't a valid excuse at this point.
Can I pay my AT&T bill with your hosts file? Because I have to shut off ublock to even get the login screen to come up, because AT&T hosts their ads from the same address.
I read the title too quickly and throught it would be about a awesome new nuclear SIGINT submarine.
If you've got javascript you need me to run to make your website work (why?)
I agree that for sites presenting only static information, JavaScript ought to be unnecessary. But for browser-based video games, it's the lesser of two evils. Games like Cookie Clicker and Pirates Love Daisies could instead have been written in Flash; would that have been a better choice?
Always use an ad blocker like uBlock Origin and a no script plugin like uMatrix. However, there is still always a possibility this attack might get through anyways. Here is what I found on how to turn off HTTPS compression on Chrome and Firefox.
In Chrome download the modheader extension from:
https://chrome.google.com/webstore/detail/modheader/idgpnmonknjnojddfkpgkljpfnnfcklj?hl=en
Then set a new custom header accept-encoding to an empty value.
In Firefox do the following: Type about:config in the URL bar (Accept the disclaimer). Search for network.http.accept-encoding and double-click on it. Backup (write down) the current value. Delete the value entirely and leave an empty field in its place. Save changes. Restart Firefox.
Note: Some proxies will ignore the empty value and still compress the data. I'm uncertain yet as to a way to permanently disable compression in existing browsers in those situations. It might require the browser be recompiled without the support to be sure.
Now, by simply visiting a website owned by a malicious party, you are placing your online security at risk.
As opposed to before, when it was totally safe to visit websites owned by a malicious party?
my program [turns hosts customization on and off] for you via its rightclick tooltray icon popup menu
Analogously to "disable antivirus" controls in the notification area, I assume. That's fine provided you close all other tabs and all other programs that use the Internet before opening the bill payment form. If you have other tabs running in the background, even on a separate browser profile, the setting affects them as well.
it's a rarity when a site hosts their own ads - advertisers don't trust webmasters alleged clickview counts
How do advertisers and webmasters trust ad networks' alleged click/view counts any better? And what stops webmasters from adopting the same means of earning trust as ad networks?
all I see is unjustifiable downmods on my posts
The downmods, as I see them, are on your habit of formatting them in a spammy manner.
Anybody who willingly allows external code like ads or third party Javascript solutions should know that they are intentionally injecting potentially malicious code.
Greed is the root of all evil.
See subject: I'm on topic, hosts work here (better than anything else for more speed, security, & reliability for less).
APK
P.S.=> The rest of what you wrote is non-sequitur - ads aren't typically hosted on the same server as a website (MAYBE 1/2 a % tops) so whatever 'point' you tried to make isn't REALITY (what I said is) & yes, you can easily enable/disable hosts as I said solving the problem - it makes me laugh when people here try arguments I've DEFEATED LONG AGO over & over (it's boring for me @ this point)... apk
UBlock can't do these as well as (or @ all) hosts do 4 speed, security, & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C's
3.) Protect vs. dyndns botnet C&C's
4.) Protect vs. DGA botnet C&C's
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks/hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O use
17.) UBlock now uses hosts (no DNS benefits vs. dns issues) - poor imitation = "sincerest form of flattery"
Hosts = native vs. illogically "Bolting on 'MoAr'" & not ClarityRay blockable like addons.
APK
P.S.=> Hosts (1st resolver) do MORE w/ less in fast kernelmode & before slow usermode addons
Hosts ~3mb vs. UBlock = 64MB -> http://cdn.ghacks.net/wp-conte...
See subject: Either works to disable hosts + my program does it for you via its rightclick tooltray icon popup menu (& it's a rarity when a site hosts their own ads - advertisers don't trust webmasters alleged clickview counts is why - I don't blame them either)
YOU CAN DOWNMOD ME ALL DAY TO HIDE YOUR FAILS LIKE YOU DID LAST TIME I POSTED THIS VALID ANSWER FOOLS https://yro.slashdot.org/comments.pl?sid=9484181&cid=52645601 & IT DOESN'T MATTER - I JUST REPOST IT!
APK
P.S.=> And there you go/voila easy as apple pie - & all I see is unjustifiable downmods on my posts regarding hosts blatant overall HUGE superiority vs. addons on most every level there is... yet NOBODY proves me validly technically wrong on them either (impossible to do - I use verified facts)... apk
APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...
Ads rob speed, security (malvertising), privacy (tracking).
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.
Works vs. caps & PUSH ads.
Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.
Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.
Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).
Gets data via 10 security sites.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )
The Janrain one I'm pretty sure is related to Slashdot's role as a relying party for login with OAuth-based identity providers, such as Google, Facebook, and Twitter. I've written elsewhere about how the switch from OpenID 2 to OpenID Connect transformed an O(n) problem into an O(n^2) one. Slashdot can sign up for a separate client key and secret with every single identity provider out there, or it can sign up for a single client key and secret with Janrain.
UBlock can't do these as well as (or @ all) hosts do 4 speed, security, & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C's
3.) Protect vs. dyndns botnet C&C's
4.) Protect vs. DGA botnet C&C's
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks/hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O use
17.) UBlock now uses hosts (no DNS benefits vs. dns issues) - poor imitation = "sincerest form of flattery"
Hosts = native vs. illogically "Bolting on 'MoAr'" & not ClarityRay blockable like addons.
APK
P.S.=> Hosts (1st resolver) do MORE w/ less in fast kernelmode & before slow usermode addons
Hosts ~3mb vs. UBlock = 64MB -> http://cdn.ghacks.net/wp-conte...
Adblock can't do (or do as well) 16 things hosts do 4 speed, security & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C servers
3.) Protect vs. dynamic dns botnet C&C servers
4.) Protect vs. DGA botnet C&C servers
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS redirect poisoned/downed dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks & hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O us
* ANSWER ="NO"
APK
P.S.=> Ab+ does less vs. hosts less efficiently (a 128-151mb memory hog http://cdn.ghacks.net/wp-conte...)
ClarityRay defeats it
Ab+'s bribed not to work by default http://www.businessinsider.com...
AdBlock's SLOWER: http://superuser.com/questions...
Can ghostery do 16 things hosts do for speed, security, & reliability:
1.) Protect vs. malicious sites (past ads)
2.) Protect vs. fastflux botnet C&C's
3.) Protect vs. dynamic dns botnet C&C's
4.) Protect vs. DGA botnet C&C'ss
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS redirect poisoned/downed dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks & hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O use
* ANSWER ="NO" OR as well vs. hosts (natively vs. illogically inefficiently "Bolting on 'MoAr'").
APK
P.S.=> Addons do less vs. hosts & less efficiently - hosts do MORE w/ less + start w/ IP stack before REDUNDANT inefficient addons BEGIN to work!
Ghostery (Advertiser owned) "Fox guards henhouse" -> http://en.wikipedia.org/wiki/G...
I mean really? HTTPS enables an exploit?
What's next, a clean diesel engine that uber-pollutes the air? Oh right...
As opposed to previous vulnerabilities, this one is different because:
"visiting a website owned by a malicious party, you are placing your online security at risk" ...and this is news?
APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...
Ads rob speed, security (malvertising), privacy (tracking).
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.
Works vs. caps & PUSH ads.
Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.
Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.
Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).
Gets data via 10 security sites.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )
See subject: ... & I post here ALL day long (even past typical AC limits) + yes, a.fsdn.com? Don't block it in hosts for /. (simple).
APK
P.S.=> For the BEST possible custom hosts file for more speed, security, reliability & anonymity? Well, you know-> APK Hosts File Engine 9.0++ SR-4 32/64-bit https://yro.slashdot.org/comme... ... apk
Nuclear powered attack submarines have been stolen? Oh my.
I get this odd feeling that these posts are from a bot responding to the presence of words like
AdBlock
so let's see what happens now.
-=This sig has nothing to do with my comment. Move along now=-
See subject: You did a "Run, Forrest https://yro.slashdot.org/comme... RUN!!! https://yro.slashdot.org/comme... vs. the facts in those 2 posts' lists that extoll hosts SUPERIORITY (by miles on most every grounds there is) over INFERIOR bloated redundant crippled by default souled-out to advertiser addons...
* That & a TRUCKLOAD of doubtless sockpuppet downmods on my posts (which I BLOW BY easily & exhaust of modpoints, every SINGLE time, lmao!)
APK
P.S.=> That's all ANYONE has to see OR know, lol... apk
See subject: Adblock fails https://yro.slashdot.org/comme... UBlock fails https://yro.slashdot.org/comme... Ghostery fails https://yro.slashdot.org/comme...
* Thus YOU FAIL TOO for suggesting such slower USERMODE (vs. hosts in faster kernelmode) messagepassing overheads ridden BLOATED redundant ineffective "so-called 'solutions'" that are 'souled-out' to advertisers NOT DOING THEIR JOB anymore by default & on their BEST DAY they can't do a FRACTION of what hosts do for less...
APK
P.S.=> Hosts does MORE than all 3 COMBINED for far, Far, FAR LESS more efficiently for more speed, security, reliability & anonymity online... apk