5 ms·
Needs to listen to only a few hundred handshakes. Ugh. Something tells me this could be deployed on AWS large instances with some success.
by vessenes 10y ago
Needs to listen to only a few hundred handshakes. Ugh. Something tells me this could be deployed on AWS large instances with some success.
- deckar01 10y agoAs others have mentioned, the attack requires a local process that has a shared cache, so it would also require a server that has a remote code execution vulnerability.
- vessenes 10y agoMy memory is that there are ways to punch through virtualization that AWS uses and get insight into cache hits/misses of other tenants, but I'm not sure if that applies here. In that world, you just rent some time on a large AWS instance and sit around mucking with the cache timing waiting for another tenant to do some cryptography. I can't find the link to the paper now, but my thoughts went to combining these two immediately -- you can get a local process without remote code execution if you just log onto your shiny new multitenant virtual server.