3 ms·
I wrote a tool a while ago for testing network based timing attacks. Getting the measurement right is really hard, just taking the average doesn't generally wor
by aj-code 12y ago
I wrote a tool a while ago for testing network based timing attacks. Getting the measurement right is really hard, just taking the average doesn't generally work while the 10th percentile measurement is much better. I did find PHP fairly hard to exploit though, but I was trying over a network which much more difficult than locally.
The code for the tool (and a presentation pdf) is here if you're interested: https://github.com/aj-code/TimingIntrusionTool5000 https://github.com/aj-code/TimingIntrusionTool5000
- TheLoneWolfling 12y agoEven taking the straight minimum may be better.
- aj-code 12y agoYou'd think so! But that's not what I found, I found the minimum, max, and average were all crap. Even the median wasn't very good compared to the 10th percentile (which I got the idea from for here http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf)
- lucb1e 12y ago> just taking the average doesn't generally work Oh, well yeah that's what I did. Guess I'll have to look further. > the 10th percentile measurement is much better That sounds like something to try, thanks!