3 ms·

How viable is this in the real world? I could imagine it working on a lone, quiet server at 4am with no other people on it. The average server with 100s of acco

How viable is this in the real world? I could imagine it working on a lone, quiet server at 4am with no other people on it. The average server with 100s of accounts, 1000s of users all doing various stuff, that's going to introduce enough random delay to throw off your analysis. Maybe you could try to calculate averages but that's going to increase the number of requests. Would a good hosting company block an attack like this at the hardware level? I'd guess yes, but I don't know.

aj-code 12y ago
I think the reality is that this style of attack is difficult enough that it would be something of a last resort, and probably only tried on high value targets. It'd take a long time (you'd probably need 100s of millions of requests) and could be easily noticed. That said, while it's not instant game over, you don't really want this vulnerability if you can avoid it. Especially in things like authentication libraries.
Eridrus 12y ago
> How viable is this in the real world? Not really viable against a native code memcmp. Potentially viable against a comparison implemented in PHP or Java. Here's a video looking at actually implementing such attacks over LAN and internet: http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remote-timing-attacks/ http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remo... > Would a good hosting company block an attack like this at the hardware level? No, there's no generic way to defeat this. The only real limit is how granular your attacker can measure. If you're on shared hosting, you're probably the most vulnerable you can get to this (but also the most screwed already, so you probably don't cate).
- userbinator 12y ago
  Shared hosting might actually add more noise, since all the traffic to the other sites on the server will affect timings too.
bascule 12y ago
Pretty viable when you do statistical analysis across a large number of requests: http://matasano.com/research/TimeTrial.pdf http://matasano.com/research/TimeTrial.pdf https://github.com/dmayer/time_trial https://github.com/dmayer/time_trial

aj-code 12y ago

I think the reality is that this style of attack is difficult enough that it would be something of a last resort, and probably only tried on high value targets. It'd take a long time (you'd probably need 100s of millions of requests) and could be easily noticed. That said, while it's not instant game over, you don't really want this vulnerability if you can avoid it. Especially in things like authentication libraries.

Eridrus 12y ago

> How viable is this in the real world? Not really viable against a native code memcmp. Potentially viable against a comparison implemented in PHP or Java. Here's a video looking at actually implementing such attacks over LAN and internet: http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remote-timing-attacks/ http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remo... > Would a good hosting company block an attack like this at the hardware level? No, there's no generic way to defeat this. The only real limit is how granular your attacker can measure. If you're on shared hosting, you're probably the most vulnerable you can get to this (but also the most screwed already, so you probably don't cate).

userbinator 12y ago
Shared hosting might actually add more noise, since all the traffic to the other sites on the server will affect timings too.

bascule 12y ago

Pretty viable when you do statistical analysis across a large number of requests: http://matasano.com/research/TimeTrial.pdf http://matasano.com/research/TimeTrial.pdf https://github.com/dmayer/time_trial https://github.com/dmayer/time_trial