Leaky images ¶Ī few months ago, as I was catching up on the latest research about XSLeaks,

Nevertheless, the study of XSLeaks is interesting in its own right,īecause it naturally leads to a deeper understanding of browser misfeaturesĪnd implementation quirks. Reward reports of XSLeaks only on a case-by-case basis. Whereas others, such as Google’s and Twitter’s, Many bug-bounty programmes outright dismiss the impact of XSLeaks as negligible, You likely won’t get rich quickly by making XSLeaks the focus of your infosec work. To another are collectively known as cross-site leaks,īug-bounty hunters, don’t get too excited: The techniques consisting in working around the SOP to leak data from one origin The barrier between origins is in practice more porous than meets the eye. The Same-Origin Policy, browser security’s cornerstone,ĭoes provide tight isolation between different Web origins,Īnd further isolation mechanisms have been implemented over the years īut security researchers have demonstrated, Similar attacks are possible within Web browsers.

You may remember how, back in 2014, MIT researchers were able toįrom the footage captured by a high-speed camera trained on a bag of crisps. Impact includes leaking the victim’s IP address and browser fingerprint,Īs well as facilitating spearphishing attacks.An attacker can de-anonymise a fellow member of their Slack workspaceĪmong n others in no more than O(log n) HTTP requests.Linked to its file-sharing functionality.

Slack’s Web client suffers from a cross-site leak.I discovered a navigation-related XSLeak technique that resists SameSite=Lax.In this post, I show how a malicious member of a Slack workspace can exploitĪ cross-site leak in Slack’s file-sharing functionality in order to efficientlyĭe-anonymise fellow workspace members when they visit the attacker’s website

Slack firefox