5 ms·
I know you were intentionally using strcmp() to prove a different point, but I want to point out that strcmp() does not run in constant time and this function a
by brobinson 10y ago
I know you were intentionally using strcmp() to prove a different point, but I want to point out that strcmp() does not run in constant time and this function also contains a completely different vulnerability: timing attacks. You could retrieve the correct password by measuring how long it takes passwords to be rejected even if you weren't able to inject a null byte.
https://codahale.com/a-lesson-in-timing-attacks/ https://codahale.com/a-lesson-in-timing-attacks/
- umanwizard 10y agoI'm curious, has this ever been demonstrated to be feasible in practice? I mean a real example of someone getting a full password through a timing attack in a real-life (or reasonably similar to real-life) scenario.
- ufo 10y agoI don't remember a concrete example out of the top of my head but it has been demonstrated that it is possible to pull of this kind of timing attack if the attacker has a computer in the same datacenter as the target.
- ryanlol 10y agoIt's rather trivial. Google finds some pocs, http://www.scasploit.org/?p=9 http://www.scasploit.org/?p=9
- deleted 10y ago[deleted]
- l_zzie 10y ago"it's rather trivial"? Have you done it?
- deleted 10y ago[deleted]
- l_zzie 10y agoIt's pretty hard with strcmp. On modern x86_64 strcmp is vectorised and the first N bytes are compared simultaneously. I have code samples + remote exploit code against nonvectorised strcmp; I can write this up if anyone thinks it would be helpful.
- rasz_pl 10y agoI vaguely remember using script kiddie tool in ~1998 that used timing attack to guess windows 95 share passwords one letter at a time.
- Jefff 10y agoIt was used to great effect on the Xbox 360 until later vulnerabilities rendered it obsolete: http://beta.ivc.no/wiki/index.php/Xbox_360_Timing_Attack http://beta.ivc.no/wiki/index.php/Xbox_360_Timing_Attack It was literally just a careless use of memcmp to check an HMAC that allowed for it to work.