GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper published Tuesday.

The cross-origin attack allows a malicious website from one domain—say, example.com—to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains.

The security threats that can result when HTML is embedded in iframes on malicious websites have been well-known for more than a decade. Most websites restrict the cross-origin embedding of pages displaying user names, passwords, or other sensitive content through X-Frame-Options or Content-Security-Policy headers. Not all, however, do. One example is Wikipedia, which shows the usernames of people who log in to their accounts. A person who wants to remain anonymous while visiting a site they don’t trust could be outed if it contained an iframe containing a link to https://en.wikipedia.org/wiki/Main_Page.

Pixel stealing PoC for deanonymizing a user, run with other tabs open playing video. “Ground Truth” is the victim iframe (Wikipedia logged in as “Yingchenw”). “AMD” is the attack result on a Ryzen 7 4800U after 30 minutes, with 97 percent accuracy. “Intel” is the attack result for an i7-8700 after 215 minutes with 98 percent accuracy.

The researchers showed how GPU.zip allows a malicious website they created for their PoC to steal pixels one by one for a user’s Wikipedia username. The attack works on GPUs provided by Apple, Intel, AMD, Qualcomm, Arm, and Nvidia. On AMD’s Ryzen 7 4800U, GPU.zip took about 30 minutes to render the targeted pixels with 97 percent accuracy. The attack required 215 minutes to reconstruct the pixels when displayed on a system running an Intel i7-8700.

    • Rootiest
      link
      fedilink
      English
      251 year ago

      Keep your dirty cross-origin paws off my pixels!

      • @imaBEES
        link
        English
        31 year ago

        Ya know, we haven’t taken a look at our pixel tree in a few seconds…

    • @Dadifer
      link
      English
      117
      edit-2
      1 year ago

      The article is saying that the gpus use a compression that is software independent and bypasses the restrictions on iFrame cross-website loading. Chrome and Edge are affected; Safari and Firefox are not.

        • @RizzRustbolt
          link
          English
          41 year ago

          Pale Moon actually already protected against this stuff. Because the team are all crazy paranoid.

      • @EyesEyesBaby
        link
        English
        971 year ago

        In other words, this only affects Chromium based browsers.

    • @[email protected]
      link
      fedilink
      English
      281 year ago

      It’s a timing vulnerability, based on how long it takes the GPU to render the page , I think, although it’s also browser specific.

      But seems low risk… at a minimum of 30 minutes to grab a username, you’d have to be sat on the same page for a while and not notice your fans ramping up…

      Also, passwords seems a stretch. No (sane) site displays passwords.

      • geosocoOP
        link
        fedilink
        121 year ago

        Many sites have had to enable reveal passwords for people with complicated passwords not using password managers.

        It’s low risk, but their numbers are also coming from fairly dated hardware and is just proof of concept. It can almost certainly be speed up significantly.

      • @systemglitch
        link
        English
        31 year ago

        I built my pc to be silent. Case and fans. I would never year the Rams ramping up. But I also use FF shrug

      • Alimentar
        link
        fedilink
        English
        01 year ago

        What about the reveal password icon people use for complicated passwords?

    • geosocoOP
      link
      fedilink
      8
      edit-2
      1 year ago

      The problem is that so many browsers leverage hardware acceleration and offer access to the GPUs. So yes, the browsers could fix the issue, but the underlying cause is the way GPUs handle data that the attack is leveraging. Fixing it would likely involve not using hardware acceleration.

      As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel. The data-dependent compression output directly translates to data-dependent DRAM traffic and data-dependent cache occupancy. Consequently, we show that, even under the most passive threat model—where an attacker can only observe coarse-grained redundancy information of a pattern using a coarse-grained timer in the browser and lacks the ability to adaptively select input—individual pixels can be leaked. Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia). Surprisingly, our attack also succeeds on discrete GPUs, and we have preliminary results indicating the presence of software-transparent compression on those architectures as well.

      It sounds distantly similar to some of the canvas issues where the acceleration creates different artifacts which makes it possible to identify GPUs and fingerprint the browsers.

  • aard
    link
    fedilink
    English
    581 year ago

    Parts of that make me pretty angry. I prevented cross origin iframes for years, and refused to buy on pages which were embedding payment verification screens like that instead of just going to that page - and back then one of my banks even was sensible enough to fail verifications if loaded in an iframe.

    But nowadays pretty much none of the authentication bits work if you don’t allow those. It was always obvious it is a bad idea, and if it were not for those idiot designers we could just have removed support for cross origin iframes from browsers years ago. Nobody needs that, they just shouldn’t be supported at all.

    • Kbin_space_program
      link
      fedilink
      211 year ago

      Here’s one that won’t enrage you.

      Salesforce Marketing Cloud doesn’t have a way for an external site to push a Post to a landing page / custom page without allowing all external sites.

      You can’t whitelist a specific site.

  • pensa
    link
    fedilink
    261 year ago

    I wonder how long until facebook adds it to their surveillance stack.

    • Dojan
      link
      English
      131 year ago

      Bet some overworked and underappreciated engineer is working on it right as we speak.

      • pensa
        link
        fedilink
        61 year ago

        If that engineer is coding that they should not be appreciated. They are part of the problem. I don’t care about the pay or the status of being a facebook engineer. I really don’t respect any engineer that has worked for any of the FAANG companies. Those fuckers sold out their morals the second they typed the first character of the first line of code while employed there.

        • Dojan
          link
          English
          51 year ago

          Seems like an unpopular opinion. I rather get your sentiment, but I don’t think it’s that black and white.

          I’ve a friend who through Amazon (AWS) managed to leave his rather shitty country with an oppressive regime, for a much better place. I personally would never want to work at the ACRONYMCLUBS, but they do have a lot of money to swing around. If you’re from some shithole, I totally get doing some less than moral (yet still perfectly legal) work just to get yours on the dry.

          I’m glad I’ve never been forced to make such a choice but still, I get why people do it.

          • pensa
            link
            fedilink
            31 year ago

            In that situation I would view the person as self serving. Doing something to improve one’s own situation at the expense of others is not conducive to a good society. I care more about the group than one friend in a tough situation. I liken it to the trolly problem.

        • @[email protected]
          link
          fedilink
          English
          31 year ago

          Writing a single line of code for Meta, Apple, Amazon, Netflix, or Google means you don’t have any morals? That’s a pretty extreme stance. Are you at least consistent about it? Let’s see.

          By your logic, if a person has ever purchased anything from, viewed an ad served by, or used a service or product created by any of those companies, they’re part of the problem and unworthy of your respect. After all, their actions have increased their value even more directly than a developer’s actions did - and unlike the developer, they didn’t get paid for it.

          Do you apply that logic to every other for-profit corporations, just these, or some subset of them? Are nonprofits safe? Is it just developers that you have a problem with? What about product managers, scrum masters, engineering managers, HR? What about Apple storefront employees, Amazon warehouse employees, Amazon delivery drivers, Customer Service for Netflix, or content moderators for Meta?

          • pensa
            link
            fedilink
            01 year ago

            Most of what you typed is reductio ad absurdum and I will not entertain it.

            To the part that is not I will say that yes I do apply the same standard to any business or employees that uses their size to to enshittify. It’s called Right Livelihood and if more people lived by it we would not have the current problems with mega corps.

      • @[email protected]
        link
        fedilink
        English
        51 year ago

        While a bunch of NSA spies groan as (probably) a perfectly good vulnerability they paid top dollar for, dies.

  • @[email protected]
    link
    fedilink
    English
    161 year ago

    A big chunk of new websites deployed today have x-frame-options set to sameorigin because modern web framework these days typically have sensible default configuration. Now, if only WordPress also have this header in their default installation, most newly deployed websites will be covered, but alas…

    • @jsnfwlr
      link
      English
      1
      edit-2
      1 year ago

      x-frame-options is a HTTP header (an obsolete one, too - use Content-Security-Policy instead) - a frontend framework isn’t able to set that. Back end frameworks can, and probably should - or at least give you the option to with a default enabled value.

      While WordPress could be configured to set it, it probably shouldn’t do it in the PHP - the installation guides should be telling you how to do it in Apache HTTPD or Nginx, with a fallback to doing it in PHP if changing the server config isn’t available.

  • @[email protected]
    link
    fedilink
    English
    13
    edit-2
    1 year ago

    Alright, how much is the patch going to impact performance?

    As noted earlier, GPU.zip works only when the malicious attacker website is loaded into Chrome or Edge. The reason: For the attack to work, the browser must:

    allow cross-origin iframes to be loaded with cookies

    allow rendering SVG filters on iframes and delegate rendering tasks to the GPU

    Does Firefox do that?

  • DudeBoy
    link
    English
    91 year ago

    Not my pixels! I worked hard for those!

    • Fat Tony
      link
      English
      11 year ago

      deleted by creator