3 ms·
Surely using performance counters only means the attacker has to do things slowly and do other things to increase noise and so avoid detection?
by willvarfar 9y ago
Surely using performance counters only means the attacker has to do things slowly and do other things to increase noise and so avoid detection?
- Xylakant 9y agoThis is already quite a slow attack (about 1-2kb of memory per second IIRC), so if you slow that down by a single order of magnitude it might just as well become impractical.
- willvarfar 9y agoThat's plenty fast enough. Secrets are secrets.
- Xylakant 9y agoBut you need to exhaust the memory space, especially in the variants that cross VM boundaries. You can’t just go and read the few hundred bytes that contain the neighbors private TLS keys. So if you can force the attacker to read memory at a tenths of the current rate, chances of a successful attack might be severely diminished.
- willvarfar 9y agoThere are plenty of small secrets with predictable locations, especially if you defeat KALSR.