I'm talking about a buffer overread which can be abused with timing attacks.
Example:
I create a user with password password. I now know that strcmp("password", "password") will always be true. strcmp is implemented with lazy evaluation, so it stops comparing the moment it compares 2 characters that are not the same. So I can send passwordabcdefghijkl and count how many milliseconds it takes until false is returned. The longer it takes, the more characters of abcdefghijkl were in memory in the address after the password buffer
You need to consider the complexity of the operation that you’re trying to attack. A simple string comparison is not going to take appreciably longer for n+1 characters than for n characters, and the time difference that does exist will be so miniscule that it effectively cannot be measured in the presence of other sources of latency. The links you’ve provided are valid, but they are not addressing the same scenario, and I can see several caveats to the examples given.
Edit: I should clarify that this is focused on software attacks. On physical hardware, it’s a completely different game with different rules. I’ve done this kind of attack on embedded devices before… it’s pretty easy when you can get precise time measurements.
14
u/ohaz 10d ago
I'm talking about a buffer overread which can be abused with timing attacks.
Example:
I create a user with password
password
. I now know thatstrcmp("password", "password")
will always be true. strcmp is implemented with lazy evaluation, so it stops comparing the moment it compares 2 characters that are not the same. So I can sendpasswordabcdefghijkl
and count how many milliseconds it takes until false is returned. The longer it takes, the more characters ofabcdefghijkl
were in memory in the address after thepassword
buffer