GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper published Tuesday.
The cross-origin attack allows a malicious website from one domain—say, example.com—to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains.
…
The security threats that can result when HTML is embedded in iframes on malicious websites have been well-known for more than a decade. Most websites restrict the cross-origin embedding of pages displaying user names, passwords, or other sensitive content through X-Frame-Options or Content-Security-Policy headers. Not all, however, do. One example is Wikipedia, which shows the usernames of people who log in to their accounts. A person who wants to remain anonymous while visiting a site they don’t trust could be outed if it contained an iframe containing a link to https://en.wikipedia.org/wiki/Main_Page.
Pixel stealing PoC for deanonymizing a user, run with other tabs open playing video. “Ground Truth” is the victim iframe (Wikipedia logged in as “Yingchenw”). “AMD” is the attack result on a Ryzen 7 4800U after 30 minutes, with 97 percent accuracy. “Intel” is the attack result for an i7-8700 after 215 minutes with 98 percent accuracy.
The researchers showed how GPU.zip allows a malicious website they created for their PoC to steal pixels one by one for a user’s Wikipedia username. The attack works on GPUs provided by Apple, Intel, AMD, Qualcomm, Arm, and Nvidia. On AMD’s Ryzen 7 4800U, GPU.zip took about 30 minutes to render the targeted pixels with 97 percent accuracy. The attack required 215 minutes to reconstruct the pixels when displayed on a system running an Intel i7-8700.
…
Should clarify this only affects Chromium browsers
Chad firefox users unaffected
deleted by creator
Isn’t this a browser vulnerability rather than a GPU one?
It’s a timing vulnerability, based on how long it takes the GPU to render the page , I think, although it’s also browser specific.
But seems low risk… at a minimum of 30 minutes to grab a username, you’d have to be sat on the same page for a while and not notice your fans ramping up…
Also, passwords seems a stretch. No (sane) site displays passwords.
Many sites have had to enable reveal passwords for people with complicated passwords not using password managers.
It’s low risk, but their numbers are also coming from fairly dated hardware and is just proof of concept. It can almost certainly be speed up significantly.
They’re going to steal your NFTs!
All my apes, gone!
A big chunk of new websites deployed today have x-frame-options set to sameorigin because modern web framework these days typically have sensible default configuration. Now, if only WordPress also have this header in their default installation, most newly deployed websites will be covered, but alas…
Those pixel stealing whores!
Keep your dirty cross-origin paws off my pixels!
Parts of that make me pretty angry. I prevented cross origin iframes for years, and refused to buy on pages which were embedding payment verification screens like that instead of just going to that page - and back then one of my banks even was sensible enough to fail verifications if loaded in an iframe.
But nowadays pretty much none of the authentication bits work if you don’t allow those. It was always obvious it is a bad idea, and if it were not for those idiot designers we could just have removed support for cross origin iframes from browsers years ago. Nobody needs that, they just shouldn’t be supported at all.
Here’s one that won’t enrage you.
Salesforce Marketing Cloud doesn’t have a way for an external site to push a Post to a landing page / custom page without allowing all external sites.
You can’t whitelist a specific site.
If websites have iframes, you just have to adjust when you attack
Alright, how much is the patch going to impact performance?
As noted earlier, GPU.zip works only when the malicious attacker website is loaded into Chrome or Edge. The reason: For the attack to work, the browser must:
allow cross-origin iframes to be loaded with cookies
allow rendering SVG filters on iframes and delegate rendering tasks to the GPU
Does Firefox do that?
says in the article that firefox and safari aren’t affected.
common firefox w
and yet chrome will still be the default for most people
I wonder how long until facebook adds it to their surveillance stack.
My protecting every one of my precious pixels
Is there any way to hide these images?
They are getting pretty obnoxious.
