5
$\begingroup$

So there's a recent PHP package that has been written to protect against cache timing attacks, which can be seen here .

My question is... just how exploitable are cache timing attacks?

My overall impression is that they're extremely difficult to exploit and attempting to protect against them is rather like using a 1MB two-prime RSA key instead of a 2KB two-prime RSA key to protect against factorization - that it is unnecessary and impractical

$\endgroup$
3
  • 3
    $\begingroup$ Well, the attack scenario is already quite restrictive: You have to sit on the same CPU as your victim for the attack to work... $\endgroup$
    – SEJPM
    Mar 12 '16 at 15:22
  • 4
    $\begingroup$ @SEJPM It's of course a good question if you should consider that "quite restrictive" in the age of people running VM's in the cloud... Share and enjoy :) I'd of course question any code that uses base 32 or base 64 to encode secret values in the first place (before wrapping them). $\endgroup$
    – Maarten Bodewes
    Mar 12 '16 at 15:45
  • 1
    $\begingroup$ @SEJPM Have you ever kept a browser tab with javascript enabled open for several days? Then you may be vulnerable to this javascript-based cache attack $\endgroup$ Mar 12 '16 at 19:46
3
$\begingroup$

An important article from last month on ZDNet shows that cache timing attacks can be very exploitable.

Researchers at Vrije University in Amsterdam announced a new side-channel attack on Intel CPUs called NetCAT. From the article on ZDNet:

Named NetCAT, this is a vulnerability in all Intel chips that support the Data-Direct I/O Technology (Intel DDIO) and Remote Direct Memory Access (RDMA) features.

When these two features are enabled, academics have shown that they can launch an attack on remote, networked computers, and infer certain types of data that is being processed inside the CPU's cache.

To emphasize: the attacker does not need physical access to the device.

VUSec academics have shown that sending carefully crafted network packets to a DDIO-capable CPU allows an attacker to keep an eye on what else is being processed in the CPU.

In short, NetCAT allows keylogging, and the attacker can even predict the words that will be typed from an SSH session.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.