Researchers at Graz University of Technology in Austria have unveiled a new form of cyber attack known as SnailLoad that leverages network latency to infer user activity. This non-invasive attack technique has the potential to gather information about the websites visited or videos watched by targets without requiring direct access to their network traffic.

SnailLoad takes advantage of the bandwidth bottleneck that is common in most internet connections. Typically, the last mile of a user’s connection to a server is slower than the server’s connection itself. By measuring delays in packets sent to the victim, an attacker can determine when the victim’s connection is busy.

The attack operates by posing as a download of a file or website component, such as a style sheet, font, image, or advertisement, and transmitting the file at a very slow pace to monitor connection latency over an extended period. The researchers behind the technique named it ‘SnailLoad’ because, like a snail, it moves slowly, leaves traces, and has a slightly eerie quality.

Unlike many cyber attacks that require JavaScript or code execution on the victim’s device, SnailLoad simply involves the victim loading content from a server controlled by the attacker, which sends data at an exceptionally slow rate. By tracking latency patterns over time, the attacker can link specific online activities to the victim.

To recreate the SnailLoad attack, certain conditions must be met, including the victim communicating with the attacker’s server, the server having a faster internet connection than the victim’s last mile connection, and the attacker’s packets being delayed if the last mile is busy. Through this side-channel attack, attackers can infer the websites visited or videos watched by the victim.

In a user study outlined in the research paper on SnailLoad, the researchers engaged local undergraduate and graduate students who volunteered to run a measurement script using the attack technique. Strict measures were taken to ensure that no personal information was exposed, and participants were given the option to request the deletion of any collected data.

The researchers responsibly disclosed the attack to Google on March 9, with Google acknowledging its severity and investigating potential server-side mitigations for YouTube. They also shared a proof of concept on GitHub along with detailed instructions and an online demo.

SnailLoad has shown high accuracy in identifying YouTube videos watched by victims and fingerprinting websites from the top 100 most visited list. While not yet seen in the wild, the attack could impact a wide range of internet connections. Mitigating the issue poses a challenge, as it stems from fundamental bandwidth differences in network infrastructure.

As concerns over online privacy continue to escalate, SnailLoad underscores the potential for even encrypted traffic to be exploited through subtle timing differences. Addressing this new form of remote side-channel attack may require further research to develop effective countermeasures.

In conclusion, the discovery of SnailLoad underscores the evolving landscape of cyber threats and the need for ongoing vigilance and innovation in cybersecurity practices to safeguard user privacy and security in the digital age.

Lidhja e burimit