4 ms·
Have timing attacks been done successfully in JS? I imagine it's much harder since you have much less low-level control and the engine might impose too much noi
by blauditore 8y ago
Have timing attacks been done successfully in JS? I imagine it's much harder since you have much less low-level control and the engine might impose too much noise. However, wasm is a different story.
- infinity0 8y agoweb search "spy in the sandbox"
- extrapickles 8y agoYes, Someone did an ASLR bypass in JavaScript, and a key component was being able to measure time accurately. https://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf https://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pd...
- josefx 8y agoI think browsers currently have to limit the precision of their built-in timer APIs and they had to kill shared mutable state support for their thread APIs so attackers couldn't implement their own.