Preventing timing attacks on the web @ Fronteers Jam 2016

Back in April, I gave a scary talk about timing attacks at the very first Fronteers Spring Conference (https://dev.opera.com/blog/timing-attacks/). Since then, a new web technology has emerged that enables developers to prevent timing attacks from targeting their websites.

Transcript

1. @mathias
   THE DARK SIDE: EPISODE II
   FRONT-END PERFORMANCE
   

   View Slide

2. @mathias
   THE DARK SIDE: EPISODE II
   FRONT-END PERFORMANCE
   https://mths.be/bvs
   

   View Slide

3. @mathias
   THE DARK SIDE: EPISODE II
   FRONT-END PERFORMANCE
   

   View Slide

4. @mathias
   

   View Slide

5. @mathias
   

   View Slide

6. @mathias
   

   View Slide

7. @mathias
   30 ms
   

   View Slide

8. @mathias
   

   View Slide

9. @mathias
   15 ms
   

   View Slide

10. @mathias
    

    View Slide

11. @mathias
    

    View Slide

12. @mathias
    

    View Slide

13. @mathias
    

    View Slide

14. @mathias
    HEIST
    

    View Slide

15. @mathias
    

    View Slide

16. @mathias
    HTTP
    

    View Slide

17. @mathias
    HTTP
    Encrypted
    

    View Slide

18. @mathias
    HTTP
    Encrypted
    Information can be
    

    View Slide

19. @mathias
    HTTP
    Encrypted
    Information can be
    Stolen through
    

    View Slide

20. @mathias
    HTTP
    Encrypted
    Information can be
    Stolen through
    TCP windows
    

    View Slide

21. @mathias
    mths.be/bvo
    

    View Slide

22. @mathias
    “HEIST is a set of techniques that exploit timing side-channels in the
    browser […] to determine whether a response fitted into a single TCP
    window or whether it needed multiple. […] an attacker can determine
    the exact amount of bytes that were needed to send the response back
    to the client, all from within the browser. It so happens to be that
    knowing the exact size of a cross-origin resource is just what you need to
    launch a compression-based attack, which can be used to extract
    content (e.g. CSRF tokens) from any website using gzip compression.”
    

    View Slide

23. @mathias
    “HEIST is a set of techniques that exploit timing side-channels in the
    browser […] to determine whether a response fitted into a single TCP
    window or whether it needed multiple. […] an attacker can determine
    the exact amount of bytes that were needed to send the response back
    to the client, all from within the browser. It so happens to be that
    knowing the exact size of a cross-origin resource is just what you need to
    launch a compression-based attack, which can be used to extract
    content (e.g. CSRF tokens) from any website using gzip compression.”
    

    View Slide

24. @mathias
    PREVENTION
    

    View Slide

25. @mathias
    SAME-SITE COOKIES
    

    View Slide

26. @mathias
    Set-Cookie: key=value; HttpOnly; secure; SameSite=strict
    

    View Slide

27. @mathias
    Set-Cookie: key=value; HttpOnly; secure; SameSite=strict
    

    View Slide

28. @mathias
    Set-Cookie: key=value; HttpOnly; secure; SameSite=lax
    

    View Slide

29. @mathias
    BLOCK THIRD-PARTY !!!
    

    View Slide

30. @mathias
    

    View Slide

31. @mathias
    THANKS!
    Front-End Performance — The Dark Side Ep. I: mths.be/bvs
    HEIST: mths.be/bvp
    Introduction to Same-Site cookies: mths.be/bvq
    

    View Slide