Google launches XS-Leaks Wiki to secure the web against cross-site leaks

guest · Dec 7, 2020

Google launches XS-Leaks Wiki to secure the web against cross-site leaks
December 5, 2020
https://www.neowin.net/news/google-launches-xs-leaks-wiki-to-secure-the-web-against-cross-site-leaks

Cross-site leaks - also referred to as "XS-Leaks" - is a category of issues in the design of the web which allows web apps to interact with each other, even when they are not related. This leads to user data being shared across web applications, which is a serious security breach. Noting the increase in security flaws which rely on cross-site leaks, Google has now announced a knowledge base so developers and security researchers better understand the problem and build defenses around it.

Dubbed "XS-Leaks Wiki", this repository of information contains articles which explain cross-site leaks, some common attacks which hinge upon this, and the defenses you can set up against them. Along with the details of each attack, proof-of-concept code is available as well.
Click to expand...

You can find out more about cross-site leaks by visiting Google's dedicated website here or the associated GitHub repository here.
Click to expand...

Google: Fostering research on new web security threats

Each attack described in the wiki is accompanied by an overview of security features which can thwart or mitigate it; the wiki aims to provide actionable guidance to assist developers in the adoption of new browser security features such as Fetch Metadata Request Headers, Cross-Origin Opener Policy, Cross-Origin Resource Policy, and SameSite cookies.
Click to expand...

guest · Nov 24, 2021

Research has come a long way, but gaps remain – security researcher Artur Janc on the state of XS-Leaks
November 23, 2021
https://portswigger.net/daily-swig/...esearcher-artur-janc-on-the-state-of-xs-leaks

Cross-site leaks (XS-Leak) are a family of browser-side channels that can be used to infer information about users. Web developers and browser vendors often misunderstand XS-Leak bugs, which can have security and privacy implications for their applications and users.

In an upcoming talk (PDF) at the XS-Leaks Summit, security researcher Artur Janc aims to shed light on some of these misunderstandings. Janc has been working on XS-Leaks for over a decade and has helped document and fix many security issues in web applications and browsers.
Click to expand...

In a Q&A with The Daily Swig, Janc shared his perspective on XS-Leaks and what needs to be done.
[...]
What is the goal of your talk? What do you wish to raise awareness of?
As I already alluded to above, I’d like to help point web browser vendors’ attention to the problem of browsing history disclosure using the CSS :visited selector and help them prioritize fixes to improve the overall security/privacy posture of the web platform.
Click to expand...

guest · Dec 7, 2021

Fourteen new types of attacks on web browsers detected
Using the XSinator.com (XSinator) tool, the researchers analysed numerous combinations of browsers...
December 2, 2021

IT security experts have identified 14 new types of attacks on web browsers that are known as cross-site leaks, or XS-Leaks. Using XS-Leaks, a malicious website can grab personal data from visitors by interacting with other websites in the background. The researchers from Ruhr-Universität Bochum (RUB) and Niederrhein University of Applied Sciences tested how well 56 combinations of browsers and operating systems are protected against 34 different XS-Leaks.

To this end, they developed the website XSinator.com, which allowed them to automatically scan browsers for these leaks. Popular browsers such as Chrome and Firefox, for example, were vulnerable to a large number of XS-Leaks.

"XS-Leaks are often browser bugs that have to be fixed by the manufacturer," says Lukas Knittel, one of the Bochum authors of the paper.
Click to expand...

How XS-Leaks work
XS-Leaks bypass the so-called same-origin policy, one of a browser's main defenses against various types of attacks. The purpose of the same-origin policy is to prevent information from being stolen from a trusted website. In the case of XS-Leaks, attackers can nevertheless recognize individual details of a website. If these details are tied to personal data, those data can be leaked.
Click to expand...

Log in or Sign up

Google launches XS-Leaks Wiki to secure the web against cross-site leaks

guest Guest

guest Guest

guest Guest

Log in or Sign up

Google launches XS-Leaks Wiki to secure the web against cross-site leaks

guest Guest

guest Guest

guest Guest

Useful Searches