Fostering research on new web security threats

Posted by Artur Janc and terjanq, Information Security Engineers 


The web is an ecosystem built on openness and composability. It is an excellent platform for building capable applications, and it powers thousands of services created and maintained by engineers at Google that are depended on by billions of users. However, the web’s open design also allows unrelated applications to sometimes interact with each other in ways which may undermine the platform’s security guarantees.

Increasingly, security issues discovered in modern web applications hinge upon the misuse of long-standing web platform behaviors, allowing unsavory sites to reveal information about the user or their data in other web applications. This class of issues, broadly referred to as cross-site leaks (XS-Leaks), poses interesting challenges for security engineers and web browser developers due to a diversity of attacks and the complexity of building comprehensive defenses.
To promote a better understanding of these issues and protect the web from them, today marks the launch of the XS-Leaks wiki—an open knowledge base to which the security community is invited to participate, and where researchers can share information about new attacks and defenses.

The XS-Leaks wiki 
Available at xsleaks.dev (code on GitHub), the wiki explains the principles behind cross-site leaks, discusses common attacks, and proposes defense mechanisms aimed at mitigating these attacks. The wiki is composed of smaller articles that showcase the details of each cross-site leak, their implications, proof-of-concept code to help demonstrate the issue, and effective defenses. 
To improve the state of web security, we’re inviting the security community to work with us on expanding the XS-Leaks wiki with information about new offensive and defensive techniques.

Defenses 
An important goal of the wiki is to help web developers understand the defense mechanisms offered by web browsers that can comprehensively protect their web applications from various kinds of cross-site leaks. 
Each attack described in the wiki is accompanied by an overview of security features which can thwart or mitigate it; the wiki aims to provide actionable guidance to assist developers in the adoption of new browser security features such as Fetch Metadata Request Headers, Cross-Origin Opener Policy, Cross-Origin Resource Policy, and SameSite cookies.
The Security Team at Google has benefited from over a decade of productive collaboration with security experts and browser engineers to improve the security of the web platform. We hope this new resource encourages further research into creative attacks and robust defenses for a major class of web security threats. We’re excited to work together with the community to continue making the web safer for all users.

Special thanks to Manuel Sousa for starting the wiki as part of his internship project at Google, and to the contributors to the xsleaks GitHub repository for their original research in this area.

/by

Cybersecurity Advent Calendar: Let Santa in, keep hackers out!

Santa will soon come down the chimney, but there are potential entry points into your home and digital life that you should never leave open

The post Cybersecurity Advent Calendar: Let Santa in, keep hackers out! appeared first on WeLiveSecurity

/by

iPhone hack allowed device takeover via Wi‑Fi

Using a zero-click exploit, an attacker could have taken complete control of any iPhone within Wi-Fi range in seconds

The post iPhone hack allowed device takeover via Wi‑Fi appeared first on WeLiveSecurity

/by

Cybersecurity Trends 2021: Staying secure in uncertain times

ESET experts look back at some of the key themes that defined the cybersecurity landscape in the year that’s ending and give their takes on what to expect in 2021

The post Cybersecurity Trends 2021: Staying secure in uncertain times appeared first on WeLiveSecurity

/by

Turla Crutch: Keeping the “back door” open

ESET researchers discover a new backdoor used by Turla to exfiltrate stolen documents to Dropbox

The post Turla Crutch: Keeping the “back door” open appeared first on WeLiveSecurity

/by

Cyberattackers could trick scientists into producing dangerous substances

Without ever setting foot in the lab, a threat actor could dupe DNA researchers into creating pathogens, according to a study describing “an end-to-end cyber-biological attack”

The post Cyberattackers could trick scientists into producing dangerous substances appeared first on WeLiveSecurity

/by

Mobile payment apps: How to stay safe when paying with your phone

Are mobile payments and digital wallets safe? Are the apps safer than credit cards? What are the main risks? Here’s what to know.

The post Mobile payment apps: How to stay safe when paying with your phone appeared first on WeLiveSecurity

/by

Week in security with Tony Anscombe

Is your smart doorbell putting you at risk of cyberattacks? – Spotify accounts hijacked en masse – Staying safe from SIM swapping

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

/by

Europol and partners thwart massive credit card fraud scheme

The operation was carried out against fraudsters trying to monetize stolen credit card data on the internet’s seedy underbelly

The post Europol and partners thwart massive credit card fraud scheme appeared first on WeLiveSecurity

/by

FBI warns of threat actors spoofing Bureau domains, email accounts

The U.S. law enforcement agency shares a sampling of more than 90 spoofed FBI-related domains registered recently

The post FBI warns of threat actors spoofing Bureau domains, email accounts appeared first on WeLiveSecurity

/by