3 ms·
I think the ability to actually exploit timing attacks is bit over indexed. Almost all of the time you need direct access on the machine, i.e. not a webserver.
by platz 9y ago
I think the ability to actually exploit timing attacks is bit over indexed. Almost all of the time you need direct access on the machine, i.e. not a webserver. So it's more of a concern for native environments as opposed to networked environments.
- heywire 9y agoIf the system being attacked does not limit attempts, one might repeat their requests until they achieve statistical significance. The first Stripe CTF had a level that dealt with timing attacks, and that is the approach I took.
- tptacek 9y agoExcept for the fact that virtually all modern serverside applications live on shared hardware with anonymous cotenants, and all modern clientside applications are JIT'd from random websites, but sure.
- IncRnd 9y agoI'm not sure why you believe that, since your belief runs contrary to the real-world oracular attacks against .Net and Ruby on Rails. Also, see Lucky-13, POODLE, and Logjam.
- amenghra 9y agoYou should read "Remote Timing Attacks are Practical" (https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf) published in 2003 by David Brumley and Dan Boneh.