[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #11333 [Firefox Patch Issues]: Audit requestAnimationFrame() and possible timing attacks

#11333: Audit requestAnimationFrame() and possible timing attacks
--------------------------------------+-----------------------
     Reporter:  gk                    |      Owner:  mikeperry
         Type:  task                  |     Status:  new
     Priority:  major                 |  Milestone:
    Component:  Firefox Patch Issues  |    Version:
   Resolution:                        |   Keywords:
Actual Points:                        |  Parent ID:  #3059
       Points:                        |
--------------------------------------+-----------------------

Comment (by gk):

 The SVG filter attack got fixed in Fx22
 (https://bugzilla.mozilla.org/show_bug.cgi?id=711043) and testing the PoC
 for the link repainting attack to extract browsing history
 (https://bugzilla.mozilla.org/show_bug.cgi?id=884270) indicates it does
 not work against TBB based on ESR24. But we should look closer at this one
 and other attacks remain to get investigated.

 I expect more timing attacks with this API are cropping up in the
 near/middle future, so me might start thinking about avoiding all of them
 with patching requestAnimationFrame(), e.g. in a way to make it less
 precise.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/11333#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs