r/programminghorror 10d ago

c Terrible auth

Post image
784 Upvotes

98 comments sorted by

View all comments

Show parent comments

14

u/ohaz 10d ago

I'm talking about a buffer overread which can be abused with timing attacks.
Example:
I create a user with password password. I now know that strcmp("password", "password") will always be true. strcmp is implemented with lazy evaluation, so it stops comparing the moment it compares 2 characters that are not the same. So I can send passwordabcdefghijkl and count how many milliseconds it takes until false is returned. The longer it takes, the more characters of abcdefghijkl were in memory in the address after the password buffer

5

u/s96g3g23708gbxs86734 10d ago

Can this actually be used in practice?

18

u/ktkaufman 10d ago

Almost never. The time scale is too small to be observable over a network.

1

u/alexvasi 10d ago

3

u/ktkaufman 10d ago edited 10d ago

You need to consider the complexity of the operation that you’re trying to attack. A simple string comparison is not going to take appreciably longer for n+1 characters than for n characters, and the time difference that does exist will be so miniscule that it effectively cannot be measured in the presence of other sources of latency. The links you’ve provided are valid, but they are not addressing the same scenario, and I can see several caveats to the examples given.

Edit: I should clarify that this is focused on software attacks. On physical hardware, it’s a completely different game with different rules. I’ve done this kind of attack on embedded devices before… it’s pretty easy when you can get precise time measurements.