Remember to regularly count your pixels guys. You wouldn’t want to find yourself missing a handful during an important gaming tournament.
Interesting article. Looks it isn’t a huge threat. It takes a long time to carry out, and only works on crome/edge.
This is the best summary I could come up with:
The researchers found that data compression that both internal and discrete GPUs use to improve performance acts as a side channel that they can abuse to bypass the restriction and steal pixels one by one.
“We found that modern GPUs automatically try to compress this visual data, without any application involvement,” Yingchen Wang, the lead author and a researcher at the University of Texas at Austin, wrote in an email.
Most websites restrict the cross-origin embedding of pages displaying user names, passwords, or other sensitive content through X-Frame-Options or Content-Security-Policy headers.
All of the GPUs analyzed use proprietary forms of compression to optimize the bandwidth available in the memory data bus of the PC, phone, or other device displaying the targeted content.
The insights yielded a method that uses the SVG, or the scalable vector graphics image format, to maximize differences in DRAM traffic between black and white target pixels in the presence of compression.
Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia).
The original article contains 832 words, the summary contains 181 words. Saved 78%. I’m a bot and I’m open source!
