It's All About Time – Remote timing attacks in PHP

Re:It's All About Time – Remote timing attacks in PHP by pjbrunet on Friday November 28, 2014 @04:08PM (#8672180)

How viable is this in the real world? I could imagine it working on a lone, quiet server at 4am with no other people on it. The average server with 100s of accounts, 1000s of users all doing various stuff, that's going to introduce enough random delay to throw off your analysis. Maybe you could try to calculate averages but that's going to increase the number of requests. Would a good hosting company block an attack like this at the hardware level? I'd guess yes, but I don't know.

[ Parent | on HN ]

Re:It's All About Time – Remote timing attacks in PHP by Eridrus on Friday November 28, 2014 @04:47PM (#8672257)

> How viable is this in the real world?

Not really viable against a native code memcmp. Potentially viable against a comparison implemented in PHP or Java.

Here's a video looking at actually implementing such attacks over LAN and internet: http://rdist.root.org/2010/11/09/blackhat-2010-video-on-remo...

> Would a good hosting company block an attack like this at the hardware level? No, there's no generic way to defeat this. The only real limit is how granular your attacker can measure. If you're on shared hosting, you're probably the most vulnerable you can get to this (but also the most screwed already, so you probably don't cate).

[ Parent | on HN ]

Re:It's All About Time – Remote timing attacks in PHP by userbinator on Friday November 28, 2014 @09:18PM (#8672864)

Shared hosting might actually add more noise, since all the traffic to the other sites on the server will affect timings too.

[ Parent | on HN ]

Re:It's All About Time – Remote timing attacks in PHP by aj-code on Friday November 28, 2014 @04:39PM (#8672239)

I think the reality is that this style of attack is difficult enough that it would be something of a last resort, and probably only tried on high value targets. It'd take a long time (you'd probably need 100s of millions of requests) and could be easily noticed.

That said, while it's not instant game over, you don't really want this vulnerability if you can avoid it. Especially in things like authentication libraries.

[ Parent | on HN ]

Re:It's All About Time – Remote timing attacks in PHP by bascule on Friday November 28, 2014 @11:32PM (#8673082)

Pretty viable when you do statistical analysis across a large number of requests:

http://matasano.com/research/TimeTrial.pdf

https://github.com/dmayer/time_trial

[ Parent | on HN ]