This is a solid attack. I wouldn't call it beautiful, it's more like a well-considered thorough engineering tour-de-force. I'm horrified but applaud the team.<p>Here's how it works: a stack of SVG filters is created. These filters are constructed so that they will tend to be faster processing a dark pixel than they will be processing a light pixel.<p>An iframe is loaded up by the attacking site, pointing at, say, a banking site or some other target of interest. I couldn't find exact details, and my HTML skills are rusty, but I assume the iframe is a 1x1 pixel iframe, and given a pixel offset.<p>The SVG stack is loaded onto the iframe using CSS, then unloaded, then loaded, etc. a whole bunch of times, and average timing results are assessed. Based on these average times, the pixel is marked 'dark' or 'light'. Repeat for each pixel.<p>Average time per pixel is in the 1-2 second range. Per pixel. So, this is a slow attack. It could probably get an order of magnitude faster with a sort of combo of zooming and greyscale heuristics that resolves over time, though.<p>They have a number of cool graphs showing the broad spread of times, and it does look easy to distinguish; their success varies by architecture, but it's over 96% for almost every architecture they test. They show it works while multiple videos and other things that tax the GPU are playing.<p>Proposed fix: let browsers tell the GPU they need some variant of constant-time processing for an iframe. Which is super, super gross.<p>Safari and Firefox don't currently allow cross-site iframe injection, so the attack only works on Chromium-line browsers.<p>Again, eww. And, wow!
Has anyone made a law about this sort of thing yet?
If not I'll have it:<p>Axons Law - Any sufficiently fast optimisation will be repurposed as an attack vector.
The fact only chromium based browsers are effected makes me think really the problem lies with the browser. However, still using the result of compression as a delta to extract sensitive data is not exactly new.
Pixel by pixel.<p>> On AMD’s Ryzen 7 4800U, GPU.zip took about 30 minutes to render the targeted pixels with 97 percent accuracy. The attack required 215 minutes to reconstruct the pixels when displayed on a system running an Intel i7-8700.
Isn't using GPU and hardware acceleration considered experimental in browsers and the safe default to disable such features for day-to-day use?<p>Not saying to make this achievement smaller than it is, quite the opposite, it's important there is more such research.
Until Google decides whether and how to patch, it seems blocking all third-party iframes can mitigate this issue, using this uBlock Origin rule:<p>||*^$subdocument,third-party