There was a recently discovered issue with the way the IndexedDB API was implemented in Safari's WebKit engine.
This is giving IT professionals who work in an environment dominated by Apple products heartburn. The faulty implementation allows or could allow an attacker to intercept leaking browser activity in real time including the user IDs associated with vulnerable machines.
Indexed DB is a commonly used API that has a robust client-side storage system with no capacity limits. Normally it is used for caching web application data so users can view it offline at a later date but of course, it can also be used to store sensitive information.
To prevent data leaks IndexedDB developers followed the "same-origin" policy which controls which resources are allowed to access each piece of data.
Unfortunately, researchers at FingerprintJS discovered that the IndexedDB API doesn't follow the same-origin policy used by Safari 15 on macOS and the difference in policy could lead to the disclosure of sensitive information.
In order to be impacted by this issue a user has to log onto websites like YouTube and Facebook or visit service portals like Google Keep or Google Calendar. Doing so creates a new IndexedDB database and appends the Google Username.
According to the researchers who first discovered the bug:
"We checked the homepages of Alexa's Top 1000 most visited websites to understand how many websites use IndexedDB and can be uniquely identified by the databases they interact with.
The results show that more than 30 websites interact with indexed databases directly on their homepage, without any additional user interaction or the need to authenticate. We suspect this number to be significantly higher in real-world scenarios as websites can interact with databases on subpages, after specific user actions, or on authenticated parts of the page."
Worst of all is there's no good mitigation strategy here. Disabling all JavaScripts would work but would almost certainly cause other applications to fail that your organization relies on. So we're waiting on Apple to provide a fix. The good news is that they've got a solid reputation for responsiveness so we should not have to wait long.
________________________________________________________________________________________________________
"Fortune Favors Who Value Time!"
Tech issues taking up your time?
"TeQ I.Q. Makes Your Technology Simple and Easy"
Do you have Technology Frustration Like Computer Issues, Phone Issues, Tablet Issues, Smart TV Issues, Smart Car Tech Issues?
"We Take Away Your Tech Frustration and Give You the Free Time You Deserve!"
Call Robert to find how we can help you with all your Technology questions.
We are giving a Free in Person TeQ Seminar at our office in La Mesa every Wednesday from 12pm-1pm and a Free TeQ Support Q&A from 1pm-2pm. Go to https://www.teqiq.com/events for our upcoming Events and https://www.teqiq.com/seminars for info on each Seminar.
For Free Consultation Call Now Robert Black at (619) 255-4180 or visit our website https://www.teqiq.com/
Chase Bank and Others Trust TeQ I.Q. with their IT and TeQnology so can you!
