Attacking Suggest Boxes in Web Applications Over HTTPS Using Side-Channel Stochastic Algorithms

Abstract

Abstract. Web applications are subject to several types of attacks. In particular, side-channel attacks consist in performing a statistical analysis of the web traffic to gain sensitive information about a client. In this paper, we investigate how side-channel leaks can be used on search engines such as Google or Bing to retrieve the client's search query. In contrast to previous works, due to payload randomization and compression, it is not always possible to uniquely map a search query to a web traffic signature and hence stochastic algorithms must be used. They yield, for the French language, an exact recovery of search word in more than 30% of the cases. Finally, we present some methods to mitigate such side-channel leaks.

Fingerprinting Search Keywords over HTTPS at Scale

“…Thus to find a string of size n, the attacker needs to send 26 n automated search requests. Later, Schaub et al study how to use stochastic algorithm to deal with variable packet lengths considering that Google has supported variable packet lengths for a given query with payload randomization and Gzip compression since 2012 [58]. For a given length, they create a prefix tree to represent the set of all possible words based on a chosen dictionary and preform hierarchical matching based on the observed size of responded packets.…”

“…Since then, Google has adopted the use of variable-length packets for a given search query with payload randomization and compression. In [58], a stochastic algorithm is adopted to infer the keywords-for a given word length, a prefix tree is created to represent the set of all possible words based on a chosen dictionary and hierarchical matching is conducted based on the observed length of subsequent response packets.…”

Fingerprinting Keywords in Search Queries over Tor

“…Chen et al [11] showed that financial information, health profiles, and search queries were leaked over HTTPS and WPA by packet inspection. Schaub et al [34] and Sharma et al [35] also presented a black-box tool for side channel weakness quantification using the Fisher criterion. Backes et al [3] adopted a formal approach, enabling information flow analysis to detect side channel attacks.…”