3 ms·
Technically, you just need fine-grained enough measurement of the request/response delay, since you could probably use time of response to measure how many inst
by munin 9y ago
Technically, you just need fine-grained enough measurement of the request/response delay, since you could probably use time of response to measure how many instructions had been executed in response to your fuzzed input.
Over the internet, this probably gets lost in the noise, but maybe with enough inputs, it wouldn't.
- schoen 9y agoIt's theoretically possible that two branches with relevantly different behavior will each result in the execution of an equal number of instructions, though. Then you can't actually tell that the behavior behind the scenes was different if the data sent over the wire is unchanged. (By contrast, AFL can tell that a branch was taken or missed even if the output is the same because it directly sees the execution state, just like in the beginning of this JPEG synthesis example where it noticed that the first byte should be 0xff even though that didn't change the output.) But your idea is very clever and seems like a potential new application of timing attacks! Someone should definitely try this.
- regularfry 9y agoThis attack has been done, over the internet. Here's a paper about it from 2003: https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-timing.html https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-timing....