Slashdot Mirror
Old School 'Sniffing' Attacks Can Still Reveal Your Browsing History (vice.com)
An anonymous reader quotes a report from Motherboard: Most modern browsers -- such as Chrome, Firefox, and Edge, and even browsers such as FuzzyFox and DeterFox (different, security-focused versions of Firefox) -- have vulnerabilities that allow hosts of malicious websites to extract hundreds to thousands of URLs in a user's web history, per new research from the University of California San Diego. What's worse, the vulnerabilities are built into the way they structure links, meaning that major structural changes will have to take place in these browsers in order to protect user privacy. The only browser that was immune to the attacks was Tor Browser, as the browser does not keep track of a user's internet history.
The vulnerabilities have to do with why, for instance, unclicked links appear blue while visited links appear violet: there's a different set of rules and style that apply to links depending on whether they've been visited or not. However, a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history. In essence, sniffing is finding and exploiting proxies that reveal your web history. As outlined in the UC San Diego report, this sniffing could happen in a couple of ways: they could force the browser to reload multiple complex images or image transformations that differ based on whether you've visited a link or not, which would create drastic differences in the loading time for each. With this strategy, actors can test 60 sensitive URLs per second. Bad actors could exploit a "bytecode cache," which speeds up the loading time for revisiting a link that you've already visited. "By embedding a special script in a web page, the actor can test how long it takes for a web page to load and infer whether you've visited it or not," reports Motherboard. "Actors can probe 3,000 URLs per second with this method. When the vulnerability was reported to Google, the company marked the issue as "security-sensitive" but "low-priority."
The vulnerabilities have to do with why, for instance, unclicked links appear blue while visited links appear violet: there's a different set of rules and style that apply to links depending on whether they've been visited or not. However, a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history. In essence, sniffing is finding and exploiting proxies that reveal your web history. As outlined in the UC San Diego report, this sniffing could happen in a couple of ways: they could force the browser to reload multiple complex images or image transformations that differ based on whether you've visited a link or not, which would create drastic differences in the loading time for each. With this strategy, actors can test 60 sensitive URLs per second. Bad actors could exploit a "bytecode cache," which speeds up the loading time for revisiting a link that you've already visited. "By embedding a special script in a web page, the actor can test how long it takes for a web page to load and infer whether you've visited it or not," reports Motherboard. "Actors can probe 3,000 URLs per second with this method. When the vulnerability was reported to Google, the company marked the issue as "security-sensitive" but "low-priority."
Sniffing anything reveals a colorful history.
guess what I've been browsing!
Just use private browsing mode, or clear everything when you close your browser. I've been doing that for years.
""sniffing," or inferting your browsing history."
Inferting.
Say it aloud. Conjures up a bunch of things, good, bad, and just plain ol' nasty.
Good luck with that. I don't visit any of your popular sites except slashdot.org.
a bad actor building a web page can manipulate this faster loading time for visited links by "sniffing," or inferting your browsing history.
How do I get it to stop sniffing my ferts?
...option not work for you in Firefox? I have that option set, and it appears to work for me. I have several other Firefox security settings turned ON (e.g., "Block cookies from unvisited websites", and "block popup windows"). (And, no, I won't show you the entire phalanx of Firefox settings I'm using :-) )
I'll admit that some people see all these options as daunting...but I'll wager they have a neighbor or colleague who can set it up for them...and show them how to propagate those settings to all other instances of Firefox in their home network.
By embedding a special script in a web page
So, yet again, we have an example where blindingly enabling scripting is a privacy or security vulnerability that can be attacked by the people you are running the scripts for.
After a decade and a half of this, new ones appearing every few days the entire time, maybe just fucking maybe it's time for people to stop running the 500 shitware scripts that pages foist on you.
This is not exceptional. It is not rare. It is not new.
This is side-channel timing attack which is of low importance because it only allows an attack site to ask if you have been to a site or not. It cannot see your history, just if you have visited a site in the recent past. At best this could inform an attacker if you are a target of interest.
However, this could be of interest to advertisers who want to probe if you have visited their site or maybe a competitor's site. Though chances are they already know that so it's likely not worth the trouble,
Anons need not reply. Questions end with a question mark.
Disable JavaScript...
Case closed.
NoScript perfectly protects against this, and hopefully the websites that I've whitelisted won't use these tricks to sniff out my browsing history.
Inferting may be the only mode of inquirty that can help us unprehend why the giant Alaskan king crabs scuttling around on the power lines outside my home snatch only Canadian aircraft out of the sky. My sublime but rascally sefl wants to infert your devience from your browsing history, along with your last 4 digits
Just the washing instructions on life's rich tapestry
"It's working: Neville... it's working!" See subject & results from the past 2-3 months https://it.slashdot.org/commen... https://it.slashdot.org/commen... & https://it.slashdot.org/commen... + https://it.slashdot.org/commen... + https://it.slashdot.org/commen... https://it.slashdot.org/commen... & https://search.slashdot.org/co... https://search.slashdot.org/co... https://it.slashdot.org/commen... that's only recently while I've been on Linux (few months now only) & 100's of times vs. MANY other botnets/malwares etc. in the past circa 2006-early 2018 while I was on Windows: CONCRETE VISIBLE UNDENIABLE REALITY (see those links as proof).
P.S.=> ... & that's ONLY what /. reported on (there are FAR more)... apk
"classic Windows hosts trick to block the Coinhive or Crypto-Loot domains" - https://www.bleepingcomputer.com/news/security/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene/ - BLEEPING COMPUTER
ZD NET http://www.zdnet.com/article/how-to-use-a-hosts-file-to-improve-your-internet-experience/ "Hosts files really shine by letting you block ads, spyware sites, malware sites, & tracking sites"
SANS ("A related approach to the DNS issue is to create a hosts file on each system that sends requests for spyware to some place else" hosts by myself & RAMU right @ START of "malware explosion" mid 2005 on) https://isc.sans.edu/forums/di...
Aryeh Goretsky/ESET/NOD32: hosts = good security https://it.slashdot.org/comments.pl?sid=7442373&.cid=49747129/
Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/columnists/491/
Spybot S&D uses hosts.
APK
P.S.=> Malwarebytes' hpHosts hosts & RECOMMENDS my program forum.hosts-file.net/viewtopic.php?f=5&t=4290
Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017
Your premise that hostfiles are a good way to deal with advertising and malvertising is quite valid - by JazzLad April 20, 2016
his hosts program is actually pretty good by xenotransplant August 10 2015
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015
I like your host file system by Karmashock September 09 2015
that APK guy, I use his host file by rogoshen1 Tuesday March 03, 2015
I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017
* For the Win32/64 model...
APK
P.S.=> Linux model's faster/more efficient/better MERGE feature too - More coming... apk
Apk has the answer for that - really... kill automatic updates by adding a hosts file entry setting updates.steam.com or whatever to 127.0.0.1. You have to find the right hostname for each software you want to block updates on by raymorris (2726007) on Friday July 06, 2018
APK your posts on this and the hosts file posts, and more, have never been in error and/or bad advice by BlueStrat (756137) on Wednesday June 21, 2017
I support APK's stand on the hosts file and can't see why it's not used more than it is. My hosts file is 144247 lines long (4,332 Kb) it & a firewall serves me very well - by Trax3001BBS (2368736)
ABP is insufficient as a solid hosts file does everything APK reminds us about fast turtle September 17 2013
You need APK's hosts file - by Teun (17872) on Wednesday August 06, 2014
* For the Win32/64 model...
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk
The URLs you visit are not stored in history if you browse in private mode. I do nearly all my browsing in private mode. Occasionally it's a pain because I'll accidentally close a tab, and ctrl-shift-T (undo tab close) does not work because the browser doesn't know the URL you just closed. But otherwise it hasn't been any different from a regular browser. You have to manually enable extensions to work in private mode, and whitelist certain sites to be able to store cookies. The inability to undo a tab close has been the biggest headache, and it's relatively minor.
If the description in summary is accurate, it sounds like blocking scripts unless you've whitelisted the site should also be effective in preventing it as well (unless a major site which you've whitelisted gets hacked and the malware script injected). Yet another reason to disable javascript by default.
APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience in this context. Of course, your phone has to be rooted, which isn't the case with Firefox + adblock." - by chihowa on Saturday May 16, 2015
APK solution STILL relevant Thud457 June 11 2015
In a footnote, I would like to note that I find your hosts file admirable - by vel-ex-tech (4337079) on Tuesday November 24, 2015
APK's monolithic hosts file is looking pretty good at the moment - by Culture20 on Thursday November 17
you're right about hosts files - by drinkypoo (153816) on Thursday May 26
APK, I know people give you a lot of shit regarding hosts, but please don't ever stop - by nasredin (958927) on Friday June 12, 2015 @03:34PM
* For the Win32/64 model...
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk
APK is kinda right... I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works. - by bmo (77928) on Thursday October 15, 2015
get around to 'installing' a hosts file list, not sure which one, likely the one from someonewhocares.org. If it works as well as what I used for a while about ten years ago, I'll be happy. And grateful to APK for the lesson and the reminder. - by kermidge (2221646) on Wednesday March 27
I actually went and downloaded a 16k line hosts file and started using that after seeing that post, you know just for trying it out. some sites load up faster. - by gl4ss (559668) on Thursday November 17
dammit MS, you proved APK right about something by lgw
* For the Win32/64 model...
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk
(APK) is still right a hosts file really does work. It even blocked a some of the video ads that were inserted into a stream OrangeTide February 10 2016
the Host File Engine performs exactly as promised - by mmell (832646) on Thursday February 16, 2017
I do use APK's host file on all my systems at home by OrangeTide December 01 2017
I've never tried to belittle (APK's work), I've flat out said it's good - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263)
(Toss on 100,000++ users worldwide too!)
* For the Win32/64 model...
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature... apk
Who did it 1st: China or me? I did - dates are my proof https://theregister.co.uk/2017... w/ the FACT China rampantly STEALS U.S. Intellectual properties & military secrets!
* IMITATION truly IS the SINCEREST FORM of FLATTERY!!!
(... & proves hosts work vs. DNS faults in tracking you via dns request logs (since you avoid it & resolve FASTER locally using hosts) + DNS being downed OR Kaminsky REDIRECT security flaw misdirected poisoned (or vs. DNSChanger))
APK
P.S.=> Let me tell you ALL 1 thing: It's NOT EASY being "World-Class" like me (lol - 100,000++ users prove it for me) - enjoy the fruits of my labors for FREE + going FASTER/SAFER/MORE RELIABLY online (w/ a bit more anonymity too via my program)... apk
Why does the age of your school have anything to do with this?
Some 'IT expert' discovered cookies.
Now I have seen everything.
In addition to knowing a history of links so they can blue ones you visited (long ago) there are other things like zoom level of a page, including if you opened a pic in "new tab" and zoomed. Even "incognito" mode.
None of this is clobbered by erase history, or by "cleaning" programs. You have to go through pains to do it manually.
Can your software block apk spam?
...for using Lynx. Who's laughing now, suckers?!?!?
That is _basic_. Should be default setting.
I just skimmed the source (gah, why indirect through vice?). It seems that -- in their current version, at least -- those attacks need javascript interpretation. So just disabling javascript completely (as I do, and as I recommend!) keeps you safe.
Still have to do thorough reading, tho.
See subject: Via APK Hosts File Engine 2.0++ 64-bit for Linux/BSD h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p
Yields more security/speed/reliability/anonymity vs. any 1 solution (99% of threats use hostnames vs. IP address most firewalls use) more efficiently/FASTER + NATIVELY 4 less!
Vs. "Bolt on 'MoAr' illogic-logic" slowing u hosts speed u up 2 ways: Adblocks + Hardcode fav. sites u spend most time @ vs. competition loaded w/ security bugs (DNS/AntiVir) + overheads slowing u (messagepass 'souled-out' to advertisers easily detected & blocked addons + firewall filtering drivers) & their complexity leads to exploit!
* ONLY 1 of its kind in GUI 4 Linux/BSD!
(Better vs. Windows model in speed/efficiency/merge)
APK
P.S.=> Protects vs. scripts/trackers (faster vs. NoScript @ kernelmode level)/ads/DNS request tracking + redirect poisoned or downed DNS/botnets/malware downloads/malcript/email malicious payloads... apk
"It's working: Neville... it's working!" See subject & results from the past 2-3 months https://it.slashdot.org/commen... https://it.slashdot.org/commen... & https://it.slashdot.org/commen... + https://it.slashdot.org/commen... + https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://search.slashdot.org/co... https://it.slashdot.org/commen... that's only recently while I've been on Linux (few months now only) & 100's of times vs. MANY other botnets/malwares etc. in the past circa 2006-early 2018 while I was on Windows: CONCRETE VISIBLE UNDENIABLE REALITY (see those links as proof).
P.S.=> ... & that's ONLY what /. reported on (there are FAR more)... apk
"classic Windows hosts trick to block the Coinhive or Crypto-Loot domains" - https://www.bleepingcomputer.com/news/security/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene/ - BLEEPING COMPUTER
ZD NET http://www.zdnet.com/article/how-to-use-a-hosts-file-to-improve-your-internet-experience/ "Hosts files really shine by letting you block ads, spyware sites, malware sites, & tracking sites"
SANS ("A related approach to the DNS issue is to create a hosts file on each system that sends requests for spyware to some place else" hosts by myself & RAMU right @ START of "malware explosion" mid 2005 on) https://isc.sans.edu/forums/di...
Aryeh Goretsky/ESET/NOD32: hosts = good security https://it.slashdot.org/comments.pl?sid=7442373&.cid=49747129/
Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/columnists/491/
Spybot S&D uses hosts.
APK
P.S.=> Malwarebytes' hpHosts hosts & RECOMMENDS my program forum.hosts-file.net/viewtopic.php?f=5&t=4290
Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017
Your premise that hostfiles are a good way to deal with advertising and malvertising is quite valid - by JazzLad April 20, 2016
his hosts program is actually pretty good by xenotransplant August 10 2015
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015
I like your host file system by Karmashock September 09 2015
that APK guy, I use his host file by rogoshen1 Tuesday March 03, 2015
I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017
* For the Win32/64 model.
APK
P.S.=> Linux model's faster/more efficient/better MERGE feature too - More coming... apk
Apk has the answer for that - really... kill automatic updates by adding a hosts file entry setting updates.steam.com or whatever to 127.0.0.1. You have to find the right hostname for each software you want to block updates on by raymorris (2726007) on Friday July 06, 2018
APK your posts on this and the hosts file posts, and more, have never been in error and/or bad advice by BlueStrat (756137) on Wednesday June 21, 2017
I support APK's stand on the hosts file and can't see why it's not used more than it is. My hosts file is 144247 lines long (4,332 Kb) it & a firewall serves me very well - by Trax3001BBS (2368736)
ABP is insufficient as a solid hosts file does everything APK reminds us about fast turtle September 17 2013
You need APK's hosts file - by Teun (17872) on Wednesday August 06, 2014
* For the Win32/64 model.
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk
APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience in this context. Of course, your phone has to be rooted, which isn't the case with Firefox + adblock." - by chihowa on Saturday May 16, 2015
APK solution STILL relevant Thud457 June 11 2015
In a footnote, I would like to note that I find your hosts file admirable - by vel-ex-tech (4337079) on Tuesday November 24, 2015
APK's monolithic hosts file is looking pretty good at the moment - by Culture20 on Thursday November 17
you're right about hosts files - by drinkypoo (153816) on Thursday May 26
APK, I know people give you a lot of shit regarding hosts, but please don't ever stop - by nasredin (958927) on Friday June 12, 2015 @03:34PM
* For the Win32/64 model.
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk
APK is kinda right... I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works. - by bmo (77928) on Thursday October 15, 2015
get around to 'installing' a hosts file list, not sure which one, likely the one from someonewhocares.org. If it works as well as what I used for a while about ten years ago, I'll be happy. And grateful to APK for the lesson and the reminder. - by kermidge (2221646) on Wednesday March 27
I actually went and downloaded a 16k line hosts file and started using that after seeing that post, you know just for trying it out. some sites load up faster. - by gl4ss (559668) on Thursday November 17
dammit MS, you proved APK right about something by lgw
* For the Win32/64 model.
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk
(APK) is still right a hosts file really does work. It even blocked a some of the video ads that were inserted into a stream OrangeTide February 10 2016
the Host File Engine performs exactly as promised - by mmell (832646) on Thursday February 16, 2017
I do use APK's host file on all my systems at home by OrangeTide December 01 2017
I've never tried to belittle (APK's work), I've flat out said it's good - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263)
(Toss on 100,000++ users worldwide too!)
* For the Win32/64 model.
APK
P.S.=> Linux model's faster/more efficient + BETTER merge feature... apk
Who did it 1st: China or me? I did - dates are my proof https://theregister.co.uk/2017... w/ the FACT China rampantly STEALS U.S. Intellectual properties & military secrets!
* IMITATION truly IS the SINCEREST FORM of FLATTERY!!!
(... & proves hosts work vs. DNS faults in tracking you via dns request logs (since you avoid it & resolve FASTER locally using hosts) + DNS being downed OR Kaminsky REDIRECT security flaw misdirected poisoned (or vs. DNSChanger))
APK
P.S.=> Let me tell you ALL 1 thing - It's NOT EASY being "World-Class" like me (lol - 100,000++ users prove it for me) - enjoy the fruits of my labors for FREE + going FASTER/SAFER/MORE RELIABLY online (w/ a bit more anonymity too via my program)... apk
See my subject & let's see YOU do better than I have - ok? Never WILL happen from a "ne'er-do-well" fakename like you!
APK
P.S.=> Why? A fakename online is ALL YOU'LL EVER BE (or do)... apk
I strongly recommend against using your software.
You refuse to release your source code, but say it's been audited by Steven Burn. Even if every single version has been audited, that does not mean that your binaries are safe. Unless the builds are reproducible and Steven Burn is able to produce identical binaries to what you're distributing, your software should be considered untrusted. The fact that you refuse to digitally sign your software further calls into question whether the binaries can be trusted.
Your software relies on third-party hosts files, which are not guaranteed to be secure. Any of those could be compromised, containing entries that redirect otherwise legitimate hostnames to fake or malicious sites. Unless you verify that each of those hosts files have not been compromised, those should be considered points of vulnerability.
Also, hosts only prevent known malicious sites from carrying out attacks. However, as you cited, 95% of newly registered domains are spam or malware domains. Any blacklisting approach like yours is a losing battle against the volume of new malware domains. A whitelisting approach like Noscript or Umatrix will be far superior at blocking attacks from newly registered domains that you haven't blocked yet.
You failed to answer his question. Can your software block APK spam?
Also, why did you make an unprovoked personal attack against hey!? That was totally uncalled for and you know it.
And here is PROOF that you believe hosts can block speculative execution attacks. Of course, it only applies to downloading software from known malware hosts, so the security provided by your software is pretty limited.
See subject: No changing facts. No hosts program does tld/gTLD verifications OR hardcoded favorites (like China copied from me) period.
* YOU LOSE.
APK
P.S.=> That last part's ANOTHER FACT you can't deny (you losing), lol... apk
No one cares what U "think" (thought's beyond u). I won't give away code to be EFast duplicated as a malware (like happened to Google) you UNIDENTIFIABLE anonymous nobody!
IF someone doesn't like what's in hosts files? They are EASY TO EDIT (you lose).
I don't HAVE to digitally SIGN anything - those get STOLEN & ABUSED (which I've pointed out to you before WITH PROOF).
My method is BUILT-IN & was upmodded on /. as INTERESTING in of all places, CODING FOR DEFCON!
To nullify it would demand a GIGANTIC custom hackjob to offset (100's of procs/functions self-check my code MATHEMATICALLY down to 1 byte change) - nigh impossible.
APK
P.S.=> I block them as they are discovered as threats (which they STILL ARE) & it works vs. threats (plenty of evidence I put out to that effect is in this debate exchange) - you lose... apk
See subject: As long as I block sources of the downloads for it (you need to use a local exe to do it) https://it.slashdot.org/commen...
* I never attacked "hey!" - I don't even KNOW who he is so you're just IMPERSONATING me yet again is all like usual (weak & all you have - like you? Worth ZERO).
APK
P.S.=> No complaints from me, I like APK's spam. Reminds me to use a host file. Also, his stuff is free. - by aaaaaaargh! (1150173) on Tuesday November 17, 2015