Automated Black-Box Detection of Side-Channel Vulnerabilities in Web Applications
Peter Chapman and David Evans
18th
ACM Conference on Computer and Communications Security (CCS
2011), Chicago, Illinois
17-21 October 2011
Abstract
Web applications divide their state between the client and the
server. The frequent and highly dynamic client-server communication that
is characteristic of modern web applications leaves them vulnerable to
side-channel leaks, even over encrypted connections. We describe a
black-box tool for detecting and quantifying the severity of
side-channel vulnerabilities by analyzing network traffic over repeated
crawls of a web application. By viewing the adversary as a
multi-dimensional classifier, we develop a methodology to more
thoroughly measure the distinguishably of network traffic for a variety
of classification metrics. We evaluate our detection system on several
deployed web applications, accounting for proposed client and
server-side defenses. Our results illustrate the limitations of entropy
measurements used in previous work and show how our new metric based on
the Fisher criterion can be used to more robustly reveal side-channels
in web applications.
Paper
Full paper: PDF (12 pages)
Project Website
