SCIS2019  Silhouette2019124NTT   (#-/&fcabl 21+&-/l 3<BD  (fc^ _HPhfc9Aab fc6P9GZI
l C[  )"%*'lmiK;:]`jkW\Q>]`=N]`l -/

21-/l OIBR +,.(! dT8@ CXl 750,? )"eS2 0&2VE
l abLU=J;FYgD,1$2"M4 21-/ !'(.0  %) "3 ,$*#Copyright©2019 NTT corp. All Rights Reserved.

2l  Silhoue(e l 

Responsible disclosurel Copyright©2019 NTT corp. All Rights Reserved.

3Silhouette)8#-.

l !"16(H_ DJVJ CSRF9*3;*DJIG@A^d , 4;&b]N?b]l $!;.=H`S 6(1:-%FR[El b]>EH ' .a6(+)58'0*
$!;.PTB  27 /)hiZeWU
l TB'0*X\LMCgP'0*YO '0*X\K Q<X\fc
Watanabe et al., User Blocking Considered Harmful? An Attacker-controllable SideChannel to Identify Social Accounts, IEEE EuroS&P’18. Copyright©2019 NTT corp. All Rights Reserved.

4

Web
:Same Origin Policy 

evil.com






HTTP GET<script>...</script>
HTTP GET (via JavaScript)<Response><Response>

SOP  SOP!
→ID$  #"Copyright©2019 NTT corp. All Rights Reserved.

5

Web
:Same Origin Policy 

evil.com






HTTP GET<script>...</script>
HTTP GET (via JavaScript)

RTT(ms)

<Response>(≒RTT)
Copyright©2019 NTT corp. All Rights Reserved.

6

Key Idea: 

HTTP GEThttps://sns.com/john_smith(URL)
John Smith

You are blocked
by John Smith

RTT= Ta ms

RTT= Tb ms
Copyright©2019 NTT corp. All Rights Reserved.

7

Key Idea: HTTP GET!

https://sns.net/john_smith
#URL)
 (/"
"





John Smith

You are blocked
by John Smith

RTT= Ta ms

RTT= Tb ms
Copyright©2019 NTT corp. All Rights Reserved.

8 (

())Copyright©2019 NTT corp. All Rights Reserved.

9 ( )Copyright©2019 NTT corp. All Rights Reserved.

10 ( )Copyright©2019 NTT corp. All Rights Reserved.

11

Silhouetteul   ←"&l %!) l #*'u l   ←"&l %!) lCookie($u l NoScriptl l  l 



Copyright©2019 NTT corp. All Rights Reserved.

12CSRF
l Referer

CSRF Token→

Referer:example.com


hFps://example.com/post.phpl:Referer:google.com

Referer:
evil.com

CSRF

https://twitter.com/twatanabe_css
Copyright©2019 NTT corp. All Rights Reserved.

13SameSite
l #38

 Cookie

D8@&)JSI #238

example2.com,-.



example1.com+-,-BC/1EJ

NFl $?SameSiteK6HTTP'"! L<
Set-Cookie: sid=xxxx; path=/; samesite=lax
 samesite=strict

example2.com

l 5;ChromiumH%*  94A>→%*(-!M= 0:G7Copyright©2019 NTT corp. All Rights Reserved.

14: 

l !'$SameSite-1
0 3, l CCS’15 C>

-Placeholder271“The Clock is Still Ticking: Timing Attacks in the Modern Web”
Goethem et al. :Bl RefererCSRF Token    %$42/ &")*(# +.
l 65%$43*#-&.( l @?0'",/*# RTT 8A l *#D=9 +!/ )$<;9Copyright©2019 NTT corp. All Rights Reserved.

15


ll Twitter
l Twitter &$ #!"') .+%-,





: https://blog.twitter.com/engineering/en_us/topics/insights/2018/twitter_silhouette.htmll 

: https://caniuse.com/#feat=same-site-cookie-attribute SameSite(  SameSite*(Copyright©2019 NTT corp. All Rights Reserved.

16  Copyright©2019 NTT corp. All Rights Reserved.

17

Responsible disclosurel @no*1-!"plM*(6;Web&0)ca\f#<9 <39 /(nol '&,%+.
l #" !-  '&*) &0)BAC%<+$-5 <-h]
Wk
Wk

Gd
FO

QNXU
Gd 
FOHYg&0)FOIVS&0)BAC29!'4<,eRFOj
8'Di[_j($&0)BACJmLZT`b=&0)F^

29!'4<,QNXU
29!'FOIV>P?HEK.7)::)Copyright©2019 NTT corp. All Rights Reserved.

18

;/2=l :7!*+$?6>C '%& #(l +*'(EResponsible disclosure-1TPl 0/-.@

responsible disclosure 4DE5B
.?58l !"MLl (JF)A>RSUO6)N<4l #$2A&0,8;

l ),"1<39A
l KQD7Gl /=%@39

+*'HI',CB:

Copyright©2019 NTT corp. All Rights Reserved.

19

Copyright©2019 NTT corp. All Rights Reserved.

20

l A?)5)EGl Silhoue=e1720%l 2@/1$:=
l  2@C,:=

l ".#)!4&l F4"3#(B;&%'*l 9<>76.

l 20,$
l ' (/-!

D8+0 3(56 -* +Copyright©2019 NTT corp. All Rights Reserved.

21