fast and somewhat reliable cache timing

[Michal Zalewski <lcamtuf () coredump cx>]

Evening,

This party trick is not particularly exciting, but hopefully
highlights a vaguely interesting point:

http://lcamtuf.coredump.cx/cachetime/

In essence, in the past few years, browser vendors have severely
crippled CSS :visited selectors in order to prevent CSS-based history
snooping that made the headlines not long ago (see, for example,
http://wtikay.com).  Although it's fairly obvious that other privacy
side channels, such as cache timing, theoretically disclose comparable
data, the attacks demonstrated so far offered, at best, vaguely
probabilistic results (say,
http://www.cs.princeton.edu/sip/pub/webtiming.pdf). On top of that,
cache probing was considered destructive, which significantly limited
its usability.

Consequently, an argument was made that CSS :visited offered unique
performance and reliability benefits and needed to be addressed
separately, while no serious work takes place on the remaining
vectors.

My PoC exploits cache timing in Firefox in what appears to be a fairly
fast and reliable way. It is a crude hack, so it will probably fail
for some of you - but it's probably still interesting. The key point
is that to probe for cached content without immediately polluting the
cache, we abort navigation before the HTTP request is made. We also
work around setTimeout / setInterval clamps by leveraging event
delivery.

PS. If this is even remotely interesting, you may also enjoy
http://lcamtuf.coredump.cx/tangled/

Cheers,
/mz