Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Saturday June 15 2019, @11:14PM   Printer-friendly
from the javascript-is-insecure-who-knew? dept.

Submitted via IRC for SoyCow4463

Academics have come up with a new technique that leaks data about users' browsers; enough to defeat anti-fingerprinting systems and privacy-preserving browser extensions to provide ways to identify users by their browser and underlying platform in a way that has not been done before. Called "JavaScript Template Attack," this new technique revolves around the concept of JavaScript properties and the default values that browser engines return for basic JavaScript queries seeking the value of a certain property.

The researchers, all three from the Graz University of Technology, in Austria, created a system that automates the querying and collection of thousands of JavaScript properties and their default values from a user's environment.

The basic idea was to automate these queries and then rotate browsers, operating systems, hardware platform, and browser extensions, to collect the default values of all known JavaScript properties for each environment/installation. Researchers then built a matrix of each environment's default properties values, creating a template -- hence the name of JavaScript Template Attack -- for each possible detection scenario, listing all environment-dependent property values.

The research team says these templates can be used at a later point to scan a visiting user and detect specific environment details based on the default property values the user's browser's returns.

This data can be used for creating user profiles (for traffic/user fingerprinting) that break user anonymity or for devious means, like refining the targeting of zero-day exploits.

[...] Furthermore, because browsers makers tend to improve their software with new Web APIs -- all of which are controllable via JavaScript -- the number of JavaScript properties has grown in the past years and is expected to grow, and improve the accuracy of JavaScript Template Attacks even more.

Source: https://www.zdnet.com/article/javascript-template-attacks-expose-new-browser-fingerprinting-vectors/


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 0) by Anonymous Coward on Sunday June 16 2019, @06:57AM

    by Anonymous Coward on Sunday June 16 2019, @06:57AM (#856186)

    get whatever they wish done. How is this news?
    Is this theater just plausible deniability on the part of browser makers, or what? "See, we didn't want all these backdoors to function as backdoors! We just suddenly, totally, the whole crowd of us bar none, forgot what "secure" ever meant! Honest!!!"

  • (Score: 0) by Anonymous Coward on Sunday June 16 2019, @07:10AM

    by Anonymous Coward on Sunday June 16 2019, @07:10AM (#856188)

    Random delays of milliseconds for JavaScript queries. Random calculations added to pages. Browsers returning odd values for known attack vectors.

    Let the arm race CONTINUE

  • (Score: 2) by shortscreen on Sunday June 16 2019, @07:39AM (2 children)

    by shortscreen (2252) on Sunday June 16 2019, @07:39AM (#856193) Journal

    What are the odds Trump can be convinced that JS is a Chinese spying tool after which he bans it for "national security"

    • (Score: 0) by Anonymous Coward on Sunday June 16 2019, @09:39AM (1 child)

      by Anonymous Coward on Sunday June 16 2019, @09:39AM (#856214)

      Not a chance. He won't drink the covfefe.

      • (Score: 1, Funny) by Anonymous Coward on Sunday June 16 2019, @02:14PM

        by Anonymous Coward on Sunday June 16 2019, @02:14PM (#856238)

        Then tell him the real name of the thing is GonzalezScript and it came illegally through the border.

  • (Score: 0) by Anonymous Coward on Sunday June 16 2019, @07:43AM

    by Anonymous Coward on Sunday June 16 2019, @07:43AM (#856195)

    I have no idea why the malicious code gets even executed without permission. Software which does that should be deeply reviewed and rewritten, and one of solutions is just to block the JS malware. We don't have to execute it. Find websites which do not require this, in modern commercial Internet there are many e-shops, advertisements and product catalogues, and all other kinds of sites are quite extinct.

  • (Score: 0) by Anonymous Coward on Sunday June 16 2019, @11:46PM

    by Anonymous Coward on Sunday June 16 2019, @11:46PM (#856401)

    Seems to work pretty well for these sorts of things. At least for now.

(1)