1

I've read articles in the past discussing the importance of having timing attack resistant responses for information where knowing the time for evaluation would leak information about the data being processed. More than once the articles mention something along the lines of:

If every response is handled in uniform time it is possible for attackers to know how heavy of a load your server is processing based on response times.

Basically, because an attacker knows your request takes N milliseconds to respond on a normal basis, the attacker can deduce when your server is under a heavy or light load. But I have yet to read a document that shows why this information would be useful.

My question was, does this side-channel leak any valuable information and what would that information be useful for? Also if this information is useful, how to mitigate in a way besides throwing more hardware at the problem?

  • If I was interested in executing a DoS attack, knowing your current load could be very helpful. – Neil Smithline Jan 18 '16 at 20:48
  • @NeilSmithline That was the only situation I could think of but I rejected it as being not too useful to an attacker, because what would you do with that information? Isn't it trivial to guess when a website's peak hours are? (Non-working daytime hours of the country of origin.) – sethmlarson Jan 18 '16 at 20:57
  • If you were in the middle of a DoS attack, you could judge its effectiveness and how much more resources would be required to succeed? – Neil Smithline Jan 18 '16 at 21:03
  • @NeilSmithline Why not post that as an answer? I always just thought that if you were i the business to DoS someone you just throw whatever you have. What use is there in holding back? – sethmlarson Jan 18 '16 at 21:05
1

If an attacker was attempting a DoS on a server, measuring the load could provide information regarding the success of a DoS as well as help the attacker determine how much more resources are required to further the attack.

This could be helpful if resources are not freely available. Perhaps the resources are busy doing other things and will be costly to change what they are doing. Another example may be if you are purchasing time on a botnet for a DDoS. There resources cost money.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.