3 ms·
I'm not even sure code execution is strictly necessary for this style of attacks. An attacker could carefully craft network packets to force the control flow o
by phire 7y ago
I'm not even sure code execution is strictly necessary for this style of attacks.
An attacker could carefully craft network packets to force the control flow of existing software to manipulate the CPU state. They could and then use the timing differences in network packets to read data out.
Would be painfully slow, but theoretically possible.
- bannable 7y agoI don't think this is correct. The timing attacks here all require extremely high resolution timers, and network + I/O latency would obscure the variance entirely.
- dymk 7y agoPeople are able to crack poor password comparison implementations over a jittery, latency heavy network. It’s possible to get almost arbitrarily high resolution when doing timing side channel attacks, you’ll just need many more samples.
- _hl_ 7y agoA while a go there was a post on here describing exactly that. I can't find it anymore unfortunately (maybe someone else has it?), but judging from my memory of that discussion this should be doable-ish. But if you're just running a local home system the chances of being targeted with such an unreliable attack are virtually zero.