4 ms·
The vulnerability is really hard to exploit and relies on very precise timing measurements and on a specific server configuration to be exploitable. It's inter
by blantonl 6y ago
The vulnerability is really hard to exploit and relies on very precise timing measurements and on a specific server configuration to be exploitable.
It's interesting that they emphasize this is a really hard problem to solve, and for 99% of use cases this really isn't an issue to worry about.
But if you work in national security or are sensitive to security threats from nation states, this would certainly be an absolutely critical item to address or understand.
National Security and nation states would absolutely use this as a target where billions of dollars or thousands of lives could be at stake.
- tptacek 6y agoI don't know why you assume this. It's true that state-level adversaries can undertake more expensive attacks, but it doesn't follow that all expensive attacks are useful. Here, the effort required to exploit this would probably buy so many Firefox and Juniper remotes, and offer so little payoff, that it's hard to imagine it ever being exploited. Sometimes vulnerabilities are just valuable to science. The work that follows up from this could be valuable to CNE and SIGINT!