It is not the first time that the possibility of Cross-VM side-channel attacks is shown. Previous paper on the subject: - Flush+Reload: a High Resolution, Low

It is not the first time that the possibility of Cross-VM side-channel attacks is shown. Previous paper on the subject: - Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack http://eprint.iacr.org/2013/448 http://eprint.iacr.org/2013/448 - Cross-VM Side Channels and Their Use to Extract Private Keys https://www.cs.unc.edu/~reiter/papers/2012/CCS.pdf https://www.cs.unc.edu/~reiter/papers/2012/CCS.pdf Side-channels on the web are more and more present. Non-functional behaviors carry too much information if proper countermeasures are not embedded in the design of some features. For instance with autocomplete features, it is possible to know what is being typed by someone even over HTTPS by looking at the packet traffic due to autocompletion: - Keystroke Timing Analysis of on-the-fly Web Apps http://flyer.sis.smu.edu.sg/acns13-2.pdf http://flyer.sis.smu.edu.sg/acns13-2.pdf - Implementing side-channel attacks on suggest boxes in web applications http://dl.acm.org/citation.cfm?id=2490436 http://dl.acm.org/citation.cfm?id=2490436 (did not find the PDF online for free -_-, EDIT: The file happens to be available here: http://www.fileswap.com/dl/FTYVPFkN5/ http://www.fileswap.com/dl/FTYVPFkN5/ :-°) - Some slides: http://people.cse.nitc.ac.in/kartik/files/k4rtik-csu491-seminar.pdf http://people.cse.nitc.ac.in/kartik/files/k4rtik-csu491-semi... I think that while a bit scary, this is quite interesting.