from the javascript-is-insecure-who-knew? dept.
Submitted via IRC for SoyCow4463
Academics have come up with a new technique that leaks data about users' browsers; enough to defeat anti-fingerprinting systems and privacy-preserving browser extensions to provide ways to identify users by their browser and underlying platform in a way that has not been done before. Called "JavaScript Template Attack," this new technique revolves around the concept of JavaScript properties and the default values that browser engines return for basic JavaScript queries seeking the value of a certain property.
The researchers, all three from the Graz University of Technology, in Austria, created a system that automates the querying and collection of thousands of JavaScript properties and their default values from a user's environment.
The basic idea was to automate these queries and then rotate browsers, operating systems, hardware platform, and browser extensions, to collect the default values of all known JavaScript properties for each environment/installation. Researchers then built a matrix of each environment's default properties values, creating a template -- hence the name of JavaScript Template Attack -- for each possible detection scenario, listing all environment-dependent property values.
The research team says these templates can be used at a later point to scan a visiting user and detect specific environment details based on the default property values the user's browser's returns.
This data can be used for creating user profiles (for traffic/user fingerprinting) that break user anonymity or for devious means, like refining the targeting of zero-day exploits.
[...] Furthermore, because browsers makers tend to improve their software with new Web APIs -- all of which are controllable via JavaScript -- the number of JavaScript properties has grown in the past years and is expected to grow, and improve the accuracy of JavaScript Template Attacks even more.
Source: https://www.zdnet.com/article/javascript-template-attacks-expose-new-browser-fingerprinting-vectors/
(Score: 0) by Anonymous Coward on Sunday June 16 2019, @06:57AM
get whatever they wish done. How is this news?
Is this theater just plausible deniability on the part of browser makers, or what? "See, we didn't want all these backdoors to function as backdoors! We just suddenly, totally, the whole crowd of us bar none, forgot what "secure" ever meant! Honest!!!"
(Score: 0) by Anonymous Coward on Sunday June 16 2019, @07:10AM
Random delays of milliseconds for JavaScript queries. Random calculations added to pages. Browsers returning odd values for known attack vectors.
Let the arm race CONTINUE
(Score: 2) by shortscreen on Sunday June 16 2019, @07:39AM (2 children)
What are the odds Trump can be convinced that JS is a Chinese spying tool after which he bans it for "national security"
(Score: 0) by Anonymous Coward on Sunday June 16 2019, @09:39AM (1 child)
Not a chance. He won't drink the covfefe.
(Score: 1, Funny) by Anonymous Coward on Sunday June 16 2019, @02:14PM
Then tell him the real name of the thing is GonzalezScript and it came illegally through the border.
(Score: 0) by Anonymous Coward on Sunday June 16 2019, @07:43AM
I have no idea why the malicious code gets even executed without permission. Software which does that should be deeply reviewed and rewritten, and one of solutions is just to block the JS malware. We don't have to execute it. Find websites which do not require this, in modern commercial Internet there are many e-shops, advertisements and product catalogues, and all other kinds of sites are quite extinct.
(Score: 0) by Anonymous Coward on Sunday June 16 2019, @11:46PM
Seems to work pretty well for these sorts of things. At least for now.