SoK: In Search of Lost Time: A Review of JavaScript Timers in Browsers - CRISTAL-SPIRALS Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

SoK: In Search of Lost Time: A Review of JavaScript Timers in Browsers

Résumé

JavaScript-based timing attacks have been greatly explored over the last few years. They rely on subtle timing differences to infer information that should not be available inside of the JavaScript sandbox. In reaction to these attacks, the W3C and browser vendors have implemented several countermeasures, with an important focus on JavaScript timers. However, as these attacks multiplied in the last years, so did the countermeasures, in a cat-and-mouse game fashion. In this paper, we present the evolution and current situation of timing attacks in browsers, as well as statistical tools to characterize available timers. Our goal is to present a clear view of the attack surface and understand: what are the main prerequisites and classes of browser-based timing attacks and what are the main countermeasures. We focus on determining to what extent the changes on timing-based countermeasures impact browser security. In particular, we show that the shift in protecting against transient execution attacks has re-enabled other attacks such as microarchitectural side-channel attacks with a higher bandwidth than what was possible just two years ago.
Fichier principal
Vignette du fichier
eurosp21_rokicki.pdf (286.81 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03215569 , version 1 (03-05-2021)
hal-03215569 , version 2 (12-08-2022)

Identifiants

  • HAL Id : hal-03215569 , version 2

Citer

Thomas Rokicki, Clémentine Maurice, Pierre Laperdrix. SoK: In Search of Lost Time: A Review of JavaScript Timers in Browsers. 6th IEEE European Symposium on Security and Privacy (EuroS&P'21), Sep 2021, Vienna, Austria. ⟨hal-03215569v2⟩
391 Consultations
764 Téléchargements

Partager

Gmail Facebook X LinkedIn More