4 ms·
If it's a timing attack, they probably don't need to fully turn it off, but turn it off and on randomly every now and then..
by mozumder 9y ago
If it's a timing attack, they probably don't need to fully turn it off, but turn it off and on randomly every now and then..
- Skunkleton 9y agoThat wont do it. The true data will still bias the results.
- mozumder 9y agoSo, Google and Apple ended up reducing precision on their web browser timing APIs to mitigate this attack.
- Skunkleton 9y agoExactly. They never expose a timer of sufficient resolution. That is different from _sometimes_ exposing a timer of sufficient resolution.
- emn13 9y agoEven this PoC was limited to 2000 bytes a second; even a little noise may well render the attack largely theoretical - or at least make the attack so slow as to make it feasible to use other (expensive) mitigations only very rarely. But yeah, it's not a brilliant solution. But it would help.
- Skunkleton 9y agoEven one byte per minute would be enough to cause serious issues. Imagine if some add served up by a torrent site could read information from another tab rendered by the same process?
- emn13 9y agoNot good, but still thousands of times better. And don't forget that you still need to guess where to read from, which better be a very very accurate guess at that rate. Making such an accurate guess is difficult when your runtime is as complex as a browsers, and so even without that extra timing noise no PoC exists (AFAIK?) attacking browsers. But you know... you're not wrong ;-). I'm just not particularly worried about the likelihood of this attack hitting anything I care about anytime very soon.
- Skunkleton 9y agoGoogle does have a PoC for spectre that attacks Chrome via Javascript. That said, I am not super worried either. Its not like all my personal data isn't already out there for all to see (Thanks Equifax).
- IncRnd 9y agoSide-channel timing attacks work on websites by executing MANY similar requests. In a similar way, in this case, while individual requests may not appear to adhere to a timing profile, over time they likely will still be discoverable. c.f. The random number generator in "The Mythical Man Month" that only guaranteed any one number will be random, not a sequence of numbers.
- mozumder 9y agoMakes sense. But man these attacks really do need lots and lots of CPU just to extract one bit of data.