3 ms·
Has there ever been a real-world attack of this type? All kinds of things are possible, but you don't cut your leg off because theoretically you might possibly
by thrower123 5y ago
Has there ever been a real-world attack of this type?
All kinds of things are possible, but you don't cut your leg off because theoretically you might possibly one day get gangrene from an ingrown toenail.
- mhh__ 5y agoI assume the triple letters have done it, but these attacks require a lot of careful planning so why bother when you can exploit something else. That kind of protects us, but these exploits are terrifying for purveyors of homogenous interfaces (i.e. the cloud) that can be attacked in ways you are already imagining. Also, anyone deploying this won't be stupid enough to chat.
- dijit 5y agoYes there are working proofs of concept using JavaScript for this kind of attack. https://leaky.page/ https://leaky.page/ Is a good example The proof of concept code has been further mitigated by removing high precision timers from JavaScript in most/all browsers; however it is not terribly difficult to create code which bypasses that restriction. The only thing that’s prevented more investment into this method of attack is that it has essentially no value due to everyone being immune.
- msbarnett 5y agoThere are working proof of concept attacks. The only reason you don’t hear more about this is that the mitigations being complained about here are universally enabled in the most vulnerable targets, like cloud hosts. Otherwise it would be pretty trivial to weaponize the original demonstration, deploy an image to AWS or Google Cloud and read out all your neighbours’ secrets. The success of the mitigations in rendering these attacks unworkable is literally the only reason people are under the mistaken impression that the cost of the mitigations isn’t worth it “because these attacks don’t happen”.