Protect yourself against a pure CSS data stealing attack called Exfil

[shmu26]

Content source

https://www.ghacks.net/2019/04/02/protect-yourself-against-a-pure-css-data-stealing-attack-called-exfil/

CSS Exfil Protection is a browser extension for Mozilla Firefox and Google Chrome that protects data against CSS Exfil attacks.

Internet users who have a good understanding of online security know that JavaScript is a great technology but also something that can be used in attacks. There are plenty of solutions available to deal with JavaScript-based attacks including using content blockers like uBlock Origin, extensions like NoScript that block JavaScript executions, or disabling JavaScript outright (the latter is not very practical).

An attack, named CSS Exfil (from exfiltrate), uses CSS to steal data. Mike Gualtieri, the researcher who discovered the vulnerability, published several proof of concept attacks designed to steal usernames, passwords, and other data on web pages it is used on.

Mike Gualtieri created a vulnerability tester that returns whether the web browser is vulnerable to CSS Exfil attacks. Just visit the web page in question to see if the browser is vulnerable or not. The page is just testing the vulnerability but not abusing it in any way.

What makes the attack particularly problematic is that it does not rely on JavaScript and that browsers don't offer any form of protection against it.

Protect yourself against a pure CSS data stealing attack called Exfil - gHacks Tech News

CSS Exfil Protection is a browser extension for Mozilla Firefox and Google Chrome that protects data against CSS Exfil attacks.

www.ghacks.net

 

[HarborFront]

Add more extensions and some people will disagree.

Anyway, I have this extension protecting my browsers.....you know my having more extensions style

 

[shmu26]

Add more extensions and some people will disagree.

Anyway, I have this extension protecting my browsers.....you know my having more extensions style

This one says it is offering a unique protection, although I haven't heard much about this type of attack. Anyone?

 

[Local Host]

This one says it is offering a unique protection, although I haven't heard much about this type of attack. Anyone?

This attack vector was actually discovered last year.

Using CSP will patch this exploit server side, but most website designers are either lazy or lack the knowledge to do so (there lots of webmasters that don't even what CSP is, leave alone implement it).

Client side is a different history, the browser itself needs to block remote URLs.

You can find detailed information here, Stealing Data With CSS: Attack and Defense

 

[TairikuOkami]

So the webpage has to be exploited first in order to be able to exploit the user.

Utilize an injection flaw to add a fake password input into the page and use CSS Exfil to steal password.

I guess only if the password is saved within the browser or if there is password autofill involved?

 

[Moonhorse]

I added this extension to chrome and visited some sites in hopes of getting alert by extension...oh well

I have noscript + ublock origin in basilisk browser and noscript will prevent this attack anyways

 

[Azure]

I added this extension to chrome and visited some sites in hopes of getting alert by extension...oh well

I have noscript + ublock origin in basilisk browser and noscript will prevent this attack anyways

Are you sure?

 

[Moonhorse]

Are you sure?

There are plenty of solutions available to deal with JavaScript-based attacks including using content blockers like uBlock Origin, extensions like NoScript that block JavaScript executions, or disabling JavaScript outright

NoScript Security Suite is a browser extension for the Firefox web browser designed to give users control over the content that sites may run. The extension blocks JavaScript execution by default which improves security and privacy significantly. NoScript supports other features, XSS and clickjacking attack protections and other security enhancing features.


Noscript or umatrix are great extensions, probably even ublock origin will do on medium/hard mode

 

[shmu26]

NoScript Security Suite is a browser extension for the Firefox web browser designed to give users control over the content that sites may run. The extension blocks JavaScript execution by default which improves security and privacy significantly. NoScript supports other features, XSS and clickjacking attack protections and other security enhancing features.


Noscript or umatrix are great extensions, probably even ublock origin will do on medium/hard mode

Maybe you missed this line in the article:
What makes the attack particularly problematic is that it does not rely on JavaScript

 

[Moonhorse]

Maybe you missed this line in the article:
What makes the attack particularly problematic is that it does not rely on JavaScript

Seems i did, dang :emoji_flushed: