Skip to content

Commit

Permalink
Modify defense tables (#92)
Browse files Browse the repository at this point in the history
  • Loading branch information
@terjanq
terjanq committed Dec 4, 2020
1 parent 9aa02e0 commit 998e701
Show file tree
Hide file tree
Showing 12 changed files with 73 additions and 62 deletions.
12 changes: 6 additions & 6 deletions content/docs/attacks/browser-features/corb.md
View file
Expand Up @@ -17,7 +17,7 @@ menu = "main"
weight = 2
+++

[Cross-Origin Read Blocking]({{< ref "../../defenses/secure-defaults/corb.md" >}}) (CORB) is a web platform security feature aimed at reducing the impact of speculative side-channel attacks such as Spectre. Unfortunately, blocking certain types of requests introduced a new type of XS-Leaks [^1] that allows attackers to detect if CORB was enforced on one request, but wasn't on another. Nevertheless, the introduced XS-Leaks are much less problematic than the issues actively protected by CORB (e.g. Spectre).
[Cross-Origin Read Blocking]({{< ref "/docs/defenses/secure-defaults/corb.md" >}}) (CORB) is a web platform security feature aimed at reducing the impact of speculative side-channel attacks such as Spectre. Unfortunately, blocking certain types of requests introduced a new type of XS-Leaks [^1] that allows attackers to detect if CORB was enforced on one request, but wasn't on another. Nevertheless, the introduced XS-Leaks are much less problematic than the issues actively protected by CORB (e.g. Spectre).


{{< hint info >}}
Expand Down Expand Up @@ -50,14 +50,14 @@ CORB can also allow attackers to detect when the `nosniff` header is present in
## Defense


| [Same-Site Cookies]({{< ref "../../defenses/opt-in/same-site-cookies.md" >}}) | [Fetch Metadata]({{< ref "../../defenses/opt-in/fetch-metadata.md" >}}) | [COOP]({{< ref "../../defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "../../defenses/opt-in/xfo.md" >}}) |
|:------------------:|:---------------:|:-----:|:--------------------:|
| ✔️ | ✔️ | ❌ | ❌ |

| [SameSite Cookies (Lax)]({{< ref "/docs/defenses/opt-in/same-site-cookies.md" >}}) | [COOP]({{< ref "/docs/defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "/docs/defenses/opt-in/xfo.md" >}}) | [Isolation Policies]({{< ref "/docs/defenses/isolation-policies" >}}) |
| :--------------------------------------------------------------------------------: | :-------------------------------------------------: | :---------------------------------------------------------------: | :-----------------------------------------------------------------------------------------------------------------------------------------------------: |
| ✔️ | ❌ | ❌ | [RIP]({{< ref "/docs/defenses/isolation-policies/resource-isolation" >}}) 🔗 [NIP]({{< ref "/docs/defenses/isolation-policies/navigation-isolation" >}}) |

🔗 – Defense mechanisms must be combined to be effective against different scenarios.

{{< hint tip >}}
Developers can deploy [CORP]({{< ref "../../defenses/opt-in/corp.md" >}}) in an application's subresources to force a protection similar to CORB that does not inspect responses to decide when to act. To prevent attackers from abusing this XS-Leak, generic XS-Leaks defense mechanisms are also effective.
Developers can deploy [CORP]({{< ref "/docs/defenses/opt-in/corp.md" >}}) in an application's subresources to force a protection similar to CORB that does not inspect responses to decide when to act. To prevent attackers from abusing this XS-Leak, generic XS-Leaks defense mechanisms are also effective.
{{< /hint >}}

## References
Expand Down
11 changes: 7 additions & 4 deletions content/docs/attacks/browser-features/corp.md
View file
Expand Up @@ -16,14 +16,17 @@ weight = 2

## Explanation

[Cross-Origin Resource Policy]({{< ref "../../defenses/opt-in/corp.md" >}}) (CORP) is a web platform security feature that allows websites to prevent certain resources from being loaded by other origins. This protection complements [CORB]({{< ref "../../defenses/secure-defaults/corb.md" >}}) since it is an opt-in defense, whereas CORB blocks some cross-origin reads by default. Unfortunately, similar to [CORB]({{< ref "corb.md" >}}), applications can introduce a new XS-Leak if they misconfigure the use of this protection.
[Cross-Origin Resource Policy]({{< ref "/docs/defenses/opt-in/corp.md" >}}) (CORP) is a web platform security feature that allows websites to prevent certain resources from being loaded by other origins. This protection complements [CORB]({{< ref "/docs/defenses/secure-defaults/corb.md" >}}) since it is an opt-in defense, whereas CORB blocks some cross-origin reads by default. Unfortunately, similar to [CORB]({{< ref "corb.md" >}}), applications can introduce a new XS-Leak if they misconfigure the use of this protection.

A webpage will introduce an XS-Leak if `CORP` is enforced based on user data. If a page search feature enforces `CORP` when showing results, but doesn't do so when returning no results, an attacker will be able to distinguish the two scenarios. This occurs because a page/resource protected by `CORP` will return an error when fetched cross-origin.

## Defense

An application can avoid this XS-Leak if it guarantees `CORP` is deployed in all application resources/endpoints. Moreover, generic security mechanisms that allow the invalidation of cross-site requests will also help prevent this attack.

| [Same-Site Cookies]({{< ref "../../defenses/opt-in/same-site-cookies.md" >}}) | [Fetch Metadata]({{< ref "../../defenses/opt-in/fetch-metadata.md" >}}) | [COOP]({{< ref "../../defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "../../defenses/opt-in/xfo.md" >}}) |
|:------------------:|:---------------:|:-----:|:--------------------:|
| ✔️ | ✔️ | ❌ | ❌ |
| [SameSite Cookies (Lax)]({{< ref "/docs/defenses/opt-in/same-site-cookies.md" >}}) | [COOP]({{< ref "/docs/defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "/docs/defenses/opt-in/xfo.md" >}}) | [Isolation Policies]({{< ref "/docs/defenses/isolation-policies" >}}) |
| :--------------------------------------------------------------------------------: | :-------------------------------------------------: | :---------------------------------------------------------------: | :-----------------------------------------------------------------------------------------------------------------------------------------------------: |
| ✔️ | ❌ | ❌ | [RIP]({{< ref "/docs/defenses/isolation-policies/resource-isolation" >}}) 🔗 [NIP]({{< ref "/docs/defenses/isolation-policies/navigation-isolation" >}}) |

🔗 – Defense mechanisms must be combined to be effective against different scenarios.

12 changes: 7 additions & 5 deletions content/docs/attacks/error-events.md
View file
Expand Up @@ -48,15 +48,17 @@ probeError('https://google.com/');

## Defense

The mitigation of this XS-Leak often varies depending on how applications handle certain resources. The general approach is to adopt consistent behaviors whereever possible. In specific scenarios, applications might use [Subresource Protections]({{< ref "../defenses/design-protections/subresource-protections.md" >}}) to prevent attackers from predicting a URL and going forward with an attack.
The mitigation of this XS-Leak often varies depending on how applications handle certain resources. The general approach is to adopt consistent behaviors whereever possible. In specific scenarios, applications might use [Subresource Protections]({{< ref "/docs/defenses/design-protections/subresource-protections.md" >}}) to prevent attackers from predicting a URL and going forward with an attack.

Finally, without applying bigger changes in the logic of applications, generic web platform security features can be deployed to mitigate this XS-Leak at a larger scale.

| [Same-Site Cookies]({{< ref "../defenses/opt-in/same-site-cookies.md" >}}) | [Fetch Metadata]({{< ref "../defenses/opt-in/fetch-metadata.md" >}}) | [COOP]({{< ref "../defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "../defenses/opt-in/xfo.md" >}}) |
|:--------------------------:|:---------------:|:-----:|:--------------------:|
| ✔️{{< katex>}}^{🔗}{{< /katex >}} | ✔️ | ❌ | ✔️{{< katex>}}^{🔗}{{< /katex >}} |
| [SameSite Cookies (Lax)]({{< ref "/docs/defenses/opt-in/same-site-cookies.md" >}}) | [COOP]({{< ref "/docs/defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "/docs/defenses/opt-in/xfo.md" >}}) | [Isolation Policies]({{< ref "/docs/defenses/isolation-policies" >}}) |
| :--------------------------------------------------------------------------------: | :-------------------------------------------------: | :---------------------------------------------------------------: | :------------------------------------------------------------------------------------------------------: |
| ✔️ | ❌ | ❌ | [RIP]({{< ref "/docs/defenses/isolation-policies/resource-isolation" >}}) {{< katex>}}^{1}{{< /katex >}} |

🔗 – Defense mechanisms must be combined to be effective against different scenarios.
____

1. The resource isolation policy should be enough to prevent error-based cross-site leaks, although in some scenarios without the [Framing Isolation Policy]({{< ref "/docs/defenses/isolation-policies/framing-isolation" >}}), the error events could be leaked through iframes.

## Real World Example

Expand Down
7 changes: 0 additions & 7 deletions content/docs/attacks/experiments/scroll-to-text-fragment.md
View file
Expand Up @@ -47,13 +47,6 @@ Attackers can abuse STTF to leak private information about the user that is disp
- A user is logged in to their National Health System website, where it is possible to access information about the user's past diseases and health problems. An attacker can lure the user to one of their pages and use STTF to possibly infer the user's health details. For example an attacker would find out if the victim suffers from a disease if they detect a page scroll when searching for that disease name.


## Defense

| Attack Alternative | [Same-Site Cookies]({{< ref "../../defenses/opt-in/same-site-cookies.md" >}}) | [Fetch Metadata]({{< ref "../../defenses/opt-in/fetch-metadata.md" >}}) | [COOP]({{< ref "../../defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "../../defenses/opt-in/xfo.md" >}}) |
|:-------------------:|:------------------:|:---------------:|:-----:|:--------------------:|
| IntersectionObserver (iframes)| ❌ | ❌ | ❌ | ❌ |
| Lazy Loading | ✔️ | ✔️ | ❌ | ❌ |

## References

[^1]: Privacy concerns with proposal through inducing network requests, [link](https://github.com/WICG/scroll-to-text-fragment/issues/76)
Expand Down
9 changes: 4 additions & 5 deletions content/docs/attacks/frame-counting.md
View file
Expand Up @@ -68,11 +68,10 @@ Some examples of frame counting attacks are:

## Defense

| Attack Alternative | [Same-Site Cookies]({{< ref "../defenses/opt-in/same-site-cookies.md" >}}) | [Fetch Metadata]({{< ref "../defenses/opt-in/fetch-metadata.md" >}}) | [COOP]({{< ref "../defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "../defenses/opt-in/xfo.md" >}}) |
|:-------------------:|:------------------:|:---------------:|:-----:|:--------------------:|
| iframe | ✔️ | ✔️ | ❌ | ✔️ |
| window.open | ✔️ [(if Strict)]({{< ref "../defenses/opt-in/same-site-cookies.md#lax-vs-strict" >}}) | ✔️ | ✔️ | ❌ |

| Attack Alternative | [SameSite Cookies (Lax)]({{< ref "/docs/defenses/opt-in/same-site-cookies.md" >}}) | [COOP]({{< ref "/docs/defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "/docs/defenses/opt-in/xfo.md" >}}) | [Isolation Policies]({{< ref "/docs/defenses/isolation-policies" >}}) |
| :----------------: | :--------------------------------------------------------------------------------: | :-------------------------------------------------: | :---------------------------------------------------------------: | :-------------------------------------------------------------------------: |
| iframes | ✔️ | ❌ | ✔️ | [FIP]({{< ref "/docs/defenses/isolation-policies/framing-isolation" >}}) |
| windows | ❌ | ✔️ | ❌ | [NIP]({{< ref "/docs/defenses/isolation-policies/navigation-isolation" >}}) |

## Real World Example

Expand Down
7 changes: 4 additions & 3 deletions content/docs/attacks/id-attribute.md
View file
Expand Up @@ -52,9 +52,10 @@ Some examples of `id`-attribute-based attacks are:

## Defense

| Attack Alternative | [Same-Site Cookies]({{< ref "../defenses/opt-in/same-site-cookies.md" >}}) | [Fetch Metadata]({{< ref "../defenses/opt-in/fetch-metadata.md" >}}) | [COOP]({{< ref "../defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "../defenses/opt-in/xfo.md" >}}) |
|:-------------------:|:------------------:|:---------------:|:-----:|:--------------------:|
| iframe | ✔️ | ✔️ | ❌ | ✔️ |
| [SameSite Cookies (Lax)]({{< ref "/docs/defenses/opt-in/same-site-cookies.md" >}}) | [COOP]({{< ref "/docs/defenses/opt-in/coop.md" >}}) | [Framing Protections]({{< ref "/docs/defenses/opt-in/xfo.md" >}}) | [Isolation Policies]({{< ref "/docs/defenses/isolation-policies" >}}) |
| :--------------------------------------------------------------------------------: | :-------------------------------------------------: | :---------------------------------------------------------------: | :----------------------------------------------------------------------: |
| ✔️ | ✔️ | ❌ | [FIP]({{< ref "/docs/defenses/isolation-policies/framing-isolation" >}}) |


## References

Expand Down

0 comments on commit 998e701

Please sign in to comment.