Exposing private information by timing web applications

ABSTRACT

We show that the time web sites take to respond to HTTP requests can leak private information, using two different types of attacks. The first, direct timing, directly measures response times from a web site to expose private information such as validity of an username at a secured site or the number of private photos in a publicly viewable gallery. The second, cross-site timing, enables a malicious web site to obtain information from the user's perspective at another site. For example, a malicious site can learn if the user is currently logged in at a victim site and, in some cases, the number of objects in the user's shopping cart. Our experiments suggest that these timing vulnerabilities are wide-spread. We explain in detail how and why these attacks work, and discuss methods for writing web application code that resists these attacks.

REFERENCES

• 1: Onur Aciiçmez , Werner Schindler , Çetin K. Koç, Improving Brumley and Boneh timing attack on unprotected SSL implementations, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102140]
• 2: C. Anley. Advanced SQL injection in SQL server applications, 2002. http://www.nextgenss.com/papers/advanced sql injection.pdf.
• 3: Matt Blaze. Simple UNIX time quantization package. Previously available on the web.
• 4: David Brumley , Dan Boneh, Remote timing attacks are practical, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.48 n.5, p.701-716, 5 August 2005 [doi>10.1016/j.comnet.2005.01.010]
• 5: The CAPTCHA project. http://www.captcha.net.
• 6: Edward W. Felten , Michael A. Schneider, Timing attacks on Web privacy, Proceedings of the 7th ACM conference on Computer and communications security, p.25-32, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352606]
• 7: Gallery. http://gallery.menalto.com/.
• 8: Collin Jackson , Andrew Bortz , Dan Boneh , John C. Mitchell, Protecting browser state from web privacy attacks, Proceedings of the 15th international conference on World Wide Web, May 23-26, 2006, Edinburgh, Scotland [doi>10.1145/1135777.1135884]
• 9: Markus Jakobsson. Modeling and preventing phishing attacks, 2005. http://www.informatics.indiana.edu/markus/papers/phishing_jakobsson.pdf.
• 10: Paul C. Kocher, Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems, Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology, p.104-113, August 18-22, 1996
• 11: Jesse Ruderman. The same origin policy, 2001. http://www.mozilla.org/projects/security/components/same-origin.html.
• 12: Werner Schindler, A Timing Attack against RSA with the Chinese Remainder Theorem, Proceedings of the Second International Workshop on Cryptographic Hardware and Embedded Systems, p.109-124, August 17-18, 2000
• 13: Werner Schindler. Optimized timing attacks against public key cryptosystems. Statistics and Decisions, 20:191--210, 2002.
• 14: Chris Shiflett. Cross-site request forgeries, 2004. http://shiflett.org/articles/security-corner-dec2004.
• 15: The cross-site scripting FAQ. http://www.cgisecurity.net/articles/xss-faq.shtml.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

General Terms:
Design, Experimentation, Security

Keywords:
phishing, privacy, web application security, web browser design, web spoofing