> imagine a browser that encrypts local storage with a system key. If I understand correctly, by storing different patterns of bits, Hertzbleed might be able to extract the system key from the timings to save data.
Don't you need precise clocks for this in JS? The ones that were disabled in browsers after Meltdown/Spectre.
A lot of that has since been rolled back as different mitigations have been deployed against Spectre.
Source? The MDN is very clear about precise timing not being available due to Spectre mitigations.
Re:Hertzbleed Attack
by thepangolino on Wednesday June 15, 2022 @04:44AM
(#31750539)
>by storing different patterns of bits, Hertzbleed might be able to extract the system key from the timings to save data.
Isn't that practically impossible given the amount of random software running on a regular computer nowadays? This is not based on hdd write speeds but processor timings which are affected by every single cat video you are watching.
As for the attack, imagine a browser that encrypts local storage with a system key. If I understand correctly, by storing different patterns of bits, Hertzbleed might be able to extract the system key from the timings to save data.
This might sound very theoretical, but modern OS'es (and password managers) have lots of keys like that. There's a good chance one or more of them are reachable from Javascript. And that's just what popped in my mind in two minutes, I'm sure red teams will have better ideas.
The scary part is that this is another attack in the same ugly class as Meltdown and Spectre, where the antidote is nearly as damaging as the poison.