All the major modern web browsers are vulnerable to 14 new types of ‘XS-Leak’ cross-site leak attacks that have been detected recently by the IT security analysts of the Ruhr-Universität Bochum (RUB) and the Niederrhein University of Applied Sciences.
Among all the modern web browsers the major players are also on the list like:-
- Google Chrome
- Microsoft Edge
- Safari
- Mozilla Firefox
- Opera
- Tor Browser
The attackers can steal sensitive data from a trusted website where the user enters information through a malicious website by exploiting these types of side-channel attacks that are collectively known as ‘XS-Leak’ cross-site leak attacks.
Though the Cross-site leaks are not new, but, still not all of them were identified and analyzed, so, for this reason, the root cause of these attacks is not yet clear.
How XS-Leaks work?
From a cross-origin HTTP resource, the built-in side-channels of the web platform allow the attackers to collect all the necessary data. Once the attacker has done with this, the cross-site bugs automatically start striking the popular web browsers.
Here’s what the IT security researchers stated:-
“XS-Leaks bypass the so-called same-origin policy, one of a browser’s main defenses against various types of attacks. The purpose of the same-origin policy is to prevent information from being stolen from a trusted website. In the case of XS-Leaks, attackers can nevertheless recognize individual, small details of a website. If these details are tied to personal data, those data can be leaked.”
Finding the new XS-Leaks
Initially, to find the new XS-Leaks the security experts have discovered three characteristics of cross-site leaks, and here they are mentioned below:-
- Inclusion methods
- Leak techniques
- Detectable differences
After discovering these three characteristics, all the inclusion methods were assessed by them, and then on a large set of web browsers, they implemented the leak techniques.
After evaluating the whole thing they developed a model in which they discovered 34 XS-Leaks, and among all these Leaks they have marked 14 leaks as critical.
Moreover, for the users, they have developed a web application known as “XSinator” through which anyone can run a test to check their browsers against the 34 X-Leaks.
Mitigation
The side-channel attacks are threatening and the risks that all these attacks arise are frightening, but, the fact is that these loopholes need to be resolved by the developers only.
Here’s what the researchers suggested to mitigate these X-Leaks:-
- Deny all event handler messages.
- Minimize error message occurrences.
- Apply global limit restrictions.
- When redirection occurs create a new history property.
- To block iframe elements from loading HTML resources use X-Frame-Options.
- To control if pages can embed a resource implement the CORP header.
For now, the researchers affirmed that they are working together to know that how these flaws are common in real-world websites, and not only that even they also claimed that soon they may also launch a website-scanning tool.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.
