8 ms·
Not true, at most it increases the number of samples required. But the are other ways to simulate timers with adequate resolution.
by georgyo 6y ago
Not true, at most it increases the number of samples required. But the are other ways to simulate timers with adequate resolution.
- saagarjha 6y ago(Such as a loop.)
- namibj 6y agoNot without shared memory.
- saagarjha 6y agoThere are apparently ways to get around even this requirement.
- namibj 6y agoAre you able to substantiate that with a link or an explanation?
- saagarjha 6y agoI just realized that my comment made it appear as if you can get a high-resolution timer without SharedArrayBuffer; I don't know of anyone who has done that yet. But people have made exploits that don't rely on it: https://alephsecurity.com/2018/06/26/spectre-browser-query-cache/ https://alephsecurity.com/2018/06/26/spectre-browser-query-c...
- namibj 6y agoThere is a point where you re-key faster than your key leaks through that specific timing attack. Or re-randomize memory layout, etc. Or where the payoff (due to limits/quotas) implies a cap on the effort that's still worth it. It's like Backups: you do as much as you want to pay for, considering the amount of risk you'll be left with.
- mahkoh 6y agoPlease post an example showing that this works. I'll run the example with OS-mitigations disabled to confirm.
- dijit 6y agoThis is a browser checker that does not use the high precision timers: https://jsfiddle.net/lukelol/43015xpv/1/ https://jsfiddle.net/lukelol/43015xpv/1/
- mahkoh 6y agoIt shows "Browser not exploitable." even after rebooting with mitigations=off.
- dijit 6y agoCongratulations! Now pray that there is not another exploit that can be used. :) Like many things; security is an onion, there are layers to it and removing some of those layers can be fine because the outer layers may protect you, but ultimately you just increase risk.
- mahkoh 6y agoWhy did you even post if you were going to resort to "but can you prove that there isn't an exploit?" anyway? I could have saved myself two reboots if you had started with that.
- dijit 6y agoI assume good faith, you asked for an exploit that works without precision timers to test, I provided one. Don’t get mad about the fact it didn’t work, I’m glad it didn’t work, but you can’t walk away with the knowledge that something like that will _never_ work. I’m not sure what you were trying to prove, but you can’t tell people to prove you wrong without any knowledge of what browser you’re running with, or what version or what you’re expecting to see. A “fully working” exploit for the most modern browser is probably possible frankly, but it’s not something that anyone is looking at with seriousness because everyone has mitigation’s enabled anyway. It’s the very definition of high work low reward.