6 ms·

A Timing Attack In Action

39 points by darkhelmetlive 14y ago

aidenn0 14y ago
Something not mentioned here is that timing attacks have been proven effective even across the internet; you might think "Oh the jitter in TCP is going to overwhelm any leaked information," but you would be wrong.
- darkhelmetlive 14y ago
  I do have the sentence "This difference is enough to measure, even on web applications." in the fourth paragraph. Should I highlight that a bit, bold maybe? I'd also like a good reference for that, and my Google skills were failing me. Do you happen to have a link to something show that off?
  - aidenn0 14y ago
    http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
    - darkhelmetlive 14y ago
      Awesome, thanks! Added this and the other one to the post.
  - aidenn0 14y ago
    I missed that on the first read-through. Invariably when you introduce someone smart to timing attacks they will say "Oh, but that's not going to be practical over TCP/IP.
  - colonelxc 14y ago
    http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf
    - darkhelmetlive 14y ago
      Awesome, thanks!
MSM 14y ago
How does this work with hashed passwords? Wouldn't any semblance of avalanche effect make this attack useless?
- darkhelmetlive 14y ago
  It can work the same way. You just slowly figure out the hash: this pw for this user was a bit faster than all the other failures, so we know the first byte of the hash is ... If you have a bunch of hashes precomputed, you can start to figure things out pretty quick. The point is it's still leaking information about what's going on.
  - MSM 14y ago
    This makes sense, I hadn't thought of knowing the hashing method and it being unsalted. Knowing those it would be just as easy to whittle the list down exactly the same way.
    - dekz 14y ago
      Err, not exactly the same way. Sure if you have a rainbow table of all the possible values of the hash construct then it would take a negligible amount of time. Doing the math of all possible values in the Hash space you will quickly see that at this point in time and space it's not plausible to have that. You may then argue that you can have the value space of all popular passwords, but that isn't going to be any more effective than just trying all of the possible passwords.
- colonelxc 14y ago
  Hashing would make this technique less useful, but not necessarily useless. For instance, if there is no salt involved, and the hashing algorithm is known (or guessable), you can still make some use of the information leaked. The difference is that you are not being leaked information about the password, but about the hash of the password. One problem with trying to brute force an authentication over the internet is that it is slow and potentially noticeable by the server admin (then you get cut off). If you exploited a timing attack from a comparison between raw md5's or sha1's of a password, then you can use the leaked information to focus your brute force. Basically, you could use a rainbow table to help you pick what passwords to try next, getting a lot more bang for your buck. In this way you can use the combination of offline brute forcing to generate possible hashes, and the timing attack to select which passwords to actually send. Now an unknown salt would still ruin your day, just like it is designed to make life difficult for rainbow tables in the first place.
dekz 14y ago
If you're comparing plain text passwords then you've already done something wrong. You'll find the hash construct mitigates against attacks like these due to its nature, especially with a per user salt.
losethos 14y ago
http://www.biblegateway.com/passage/?search=1+Corinthians+14&version=NIV http://www.biblegateway.com/passage/?search=1+Corinthians+14... Flipping a coin to make random numbers is tedious. I stop a high speed stopwatch for random numbers. God says... Electronic comprehended proceedeth mire incongruously slumbers holies
mdonahoe 14y ago
Your post was hard to read because of your background image http://cf.verboselogging.com/assets/headshot-44822a75dfeaa891c3bb14b64f75f7fc.jpg http://cf.verboselogging.com/assets/headshot-44822a75dfeaa89...

Something not mentioned here is that timing attacks have been proven effective even across the internet; you might think "Oh the jitter in TCP is going to overwhelm any leaked information," but you would be wrong.

darkhelmetlive 14y ago
I do have the sentence "This difference is enough to measure, even on web applications." in the fourth paragraph. Should I highlight that a bit, bold maybe? I'd also like a good reference for that, and my Google skills were failing me. Do you happen to have a link to something show that off?
- aidenn0 14y ago
  http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
  - darkhelmetlive 14y ago
    Awesome, thanks! Added this and the other one to the post.
- aidenn0 14y ago
  I missed that on the first read-through. Invariably when you introduce someone smart to timing attacks they will say "Oh, but that's not going to be practical over TCP/IP.
- colonelxc 14y ago
  http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf
  - darkhelmetlive 14y ago
    Awesome, thanks!

MSM 14y ago

How does this work with hashed passwords? Wouldn't any semblance of avalanche effect make this attack useless?

darkhelmetlive 14y ago
It can work the same way. You just slowly figure out the hash: this pw for this user was a bit faster than all the other failures, so we know the first byte of the hash is ... If you have a bunch of hashes precomputed, you can start to figure things out pretty quick. The point is it's still leaking information about what's going on.
- MSM 14y ago
  This makes sense, I hadn't thought of knowing the hashing method and it being unsalted. Knowing those it would be just as easy to whittle the list down exactly the same way.
  - dekz 14y ago
    Err, not exactly the same way. Sure if you have a rainbow table of all the possible values of the hash construct then it would take a negligible amount of time. Doing the math of all possible values in the Hash space you will quickly see that at this point in time and space it's not plausible to have that. You may then argue that you can have the value space of all popular passwords, but that isn't going to be any more effective than just trying all of the possible passwords.
colonelxc 14y ago
Hashing would make this technique less useful, but not necessarily useless. For instance, if there is no salt involved, and the hashing algorithm is known (or guessable), you can still make some use of the information leaked. The difference is that you are not being leaked information about the password, but about the hash of the password. One problem with trying to brute force an authentication over the internet is that it is slow and potentially noticeable by the server admin (then you get cut off). If you exploited a timing attack from a comparison between raw md5's or sha1's of a password, then you can use the leaked information to focus your brute force. Basically, you could use a rainbow table to help you pick what passwords to try next, getting a lot more bang for your buck. In this way you can use the combination of offline brute forcing to generate possible hashes, and the timing attack to select which passwords to actually send. Now an unknown salt would still ruin your day, just like it is designed to make life difficult for rainbow tables in the first place.

dekz 14y ago

If you're comparing plain text passwords then you've already done something wrong. You'll find the hash construct mitigates against attacks like these due to its nature, especially with a per user salt.

losethos 14y ago

http://www.biblegateway.com/passage/?search=1+Corinthians+14&version=NIV http://www.biblegateway.com/passage/?search=1+Corinthians+14... Flipping a coin to make random numbers is tedious. I stop a high speed stopwatch for random numbers. God says... Electronic comprehended proceedeth mire incongruously slumbers holies

mdonahoe 14y ago

Your post was hard to read because of your background image http://cf.verboselogging.com/assets/headshot-44822a75dfeaa891c3bb14b64f75f7fc.jpg http://cf.verboselogging.com/assets/headshot-44822a75dfeaa89...