To this end, they developed the website XSinator.com, which allowed them to automatically scan browsers for these leaks. Popular browsers such as Chrome and Firefox, for example, were vulnerable to a large number of XS-Leaks. "XS-Leaks are often browser bugs that have to be fixed by the manufacturer," says Lukas Knittel, one of the Bochum authors of the paper.

The researchers published their findings online and at the ACM Conference on Computer and Communications Security, which was held as a virtual event in mid-November 2021. At the conference, Lukas Knittel, Dr. Christian Mainka, Dominik Noß and Professor Jörg Schwenk from the Horst Görtz Institute for IT-Security at RUB as well as Professor Marcus Niemietz from the Niederrhein University of Applied Sciences received a Best Paper Award for their study. The study took place within the Cluster of Excellence "CASA—Cyber Security in the Age of Large-Scale Adversaries."

How XS-Leaks work

XS-Leaks bypass the so-called same-origin policy, one of a browser's main defenses against various types of attacks. The purpose of the same-origin policy is to prevent information from being stolen from a trusted website. In the case of XS-Leaks, attackers can nevertheless recognize individual details of a website. If these details are tied to personal data, those data can be leaked. For example, emails in a webmail inbox could be read from a malicious site, because the search function would respond in a different way depending on whether there were results for a search term or not.

In order to systematically analyze XS-Leaks, the group first identified three characteristics of such attacks. Based on these, they then derived a formal model that aids in understanding XS-Leaks and helps in detecting new attacks. As a result, the researchers identified 14 new attack categories.