A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.
119

This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible. What is speculative execution and what does it do? Speculative execution is a feature of modern processors that comes as an optimisation. To allow for the parallel ...


33

There are published successes with remote timing attacks. From the document -- "... we can reliably distinguish remote timing differences as low as 20µs." So yes, you should be worried about the underlying implementation of .equals() (spoiler: Not secure). Implement .equals() using a sum of XOR of characters to compare in a timing-independent way. Here's a ...


24

In theory, this is a possible exploit, and if you are in super-paranoia mode, you should assume the answer being "Yes". In every other case, the answer will be: "No.". Although there are published papers (one is linked in the answer by @Oasiscircle) which claim that they are able to run successful timing attacks, one has to carefully read the preconditions, ...


21

Modern cryptosystems are generally not susceptible to known-plaintext attacks. In terms of encryption algorithms, there are basically 3 algorithms commonly in use in TLS: AES RC4 DES (in 3DES) All 3 of these are believed to be resistant to known-plaintext attacks, and have been well studied for such attacks. The one thing I would wonder about are side-...


20

IDSs and several deep inspection firewalls (sometimes called NGFW or UTM) can usually detect whether the traffic is HTTP or not. Also a HTTP proxy in front would simply block anything which is not proper HTTP. But be aware that it is possible to build a reverse shell where the traffic will look like HTTP, so this filtering will only help a bit.


18

From the code example provided, it is possible to determine the correct password by timing the code when given various inputs. First, you shouldn't actually examine the password directly! At the very least, you should hash the password with a password hash like Argon2id first, and compare the password hash of the input with the password hash you stored ...


15

Being able to process strings of arbitrary length without leaking information on their length seems to be very hard (i.e. I don't see how to do it) because of caches. A very long string, by definition, will take a lot of room, and thus reading the string will incur interaction with the caches. Accessing the string from RAM will trigger cache misses, and also ...


14

Store a good cryptographic hash of the secret on the server (i.e. treat it like a password). Your comparison then would be to take the hash of the string the client sends you, and compare the hashes. If the secret has high enough entropy, this should eliminate timing attacks and prevent leaking of the real secret string, since it should be practically ...


13

Side-Channel attacks are notoriously difficult to detect, because there are many side-channels that an attacker could look for. This includes, but is not limited to: Timing Attacks Cache Attacks Power-Monitoring Attacks Acoustic Cryptanalysis Wikipedia has an excellent list, from which this is just an excerpt. Since there are so many different side-...


12

No, they are not always a risk, and indeed, it is impossible to build a practical cryptographic library where every function is constant time. Take, for instance, a decryption function. In a real-world cryptographic library, it is going to be faster to decrypt a 10 byte message than a 10 gigabyte message. You could theoretically create a library where ...


11

An overt channel is a communications path that is not hidden. Anyone can see that Steve connected to Stack Exchange. A covert channel is an intentional communications path that is hidden, using a technique like steganography. This might use a technique like a dead drop, where I post a picture on eBay, you view the posting on eBay, but nobody can easily ...


10

Side Channel attacks leverage information gained from observing or interacting with a system in a way other than anticipated by its creators. Often this is done to infer information about encryption keys or other secret information. Some of the most common side channel attack vectors are: Timing Power monitoring Error handling analysis Examples for the ...


10

The attacker can easily mimic HTTP traffic, so I will doubt any IDS/IPS would prevent a well developed shell from mimicking HTTP requests to exfiltrate data. It's very easy to create a fake HTML page, embed the images with <img src="data:image/png;base64,iVBORw0KG…8bg5CYII="> and put the traffic inside. A lossless compression (like PNG) will allow ...


7

The practical impact is nil... for now. The attack is of a type known as side channel in that it exploits an information leak, here sound emission which depends on the processed data, including the private key. Under certain conditions, the leak might be leveraged into a full key recovery, but the conditions are not easily achieved in practice. As the ...


7

If nothing else, it's an API for checking passwords without any time delay. It has to be: if they had a time delay after every incorrect guess, it would defeat the point of live-checking the password. If you password is "password", then the server has to check seven incorrect passwords before reaching the correct one, and you can't afford to have a delay ...


7

Simple tips In addition to M'vy's excellent answer, I just want answer this question: What can I do in order to be safe? Spectre, Meltdown and Rowhammer are CPU conceptual bugs, so they couldn't be correctly patched by a software update. This means: Actual software patches do mostly decrase the overall performance of any system (Windows, Linux of MacOS). ...


6

Advanced IPS/IDS can help you. but there are some kinds of firewalls that are completely customized for web (HTTP/HTTPS). They are called WAFs, Web Application Firewalls. A good WAF with a proper configuration can prevent many attacks, like the one which you're speaking about.


6

Variable time comparisons will leak information. If there is no harm in revealing the data being compared, then there is no issue with using variable time comparisons. If it is crucial that it remain secret, then use constant time comparison. Some variable time comparisons that are exploitable in theory might be hard to exploit in practice. The quality of ...


6

My current understanding is that the microcode update changes the behavior of the obsolete VERW instruction so that it causes a flush of various internal processor buffers The new behavior of the VERW instruction is described in this article. In particular: The VERW instruction retains the same existing functionality, i.e., it checks whether the ...


6

I assume that the code from the question is just an intentionally trivialized example for illustration, because in a real-world system you would never store passwords in plaintext. But if you would want to replace this fictional code with an implementation which isn't vulnerable to timing attacks, then you would make sure that the algorithm doesn't terminate ...


5

@Ben's answer to compare hashes rather than keys directly seems the best-practice approach for the task, and en passant also becomes a partial solution to the problem. However, it remains vulnerable to some level of rainbow tabled hash tree: try keys that result in a hash beginning with each letter, then those beginning with the found letter and cycling the ...


5

Maybe a silly question but are you certain you're not getting a ✓ meaning that the password you have entered has met the minimum requirements for the sites password policy? Such that the client side code is saying "yes, this is a valid password and I will accept it, although I have not yet validated the correctness." When you enter the password as "...


5

You should not plug a washing machine into the same power strip as your computer or put a large number of switches in series unless you want to burn down your house. With that said... Mitigating power analysis attacks can be easy or hard depending on the adversary. If they are simply measuring power usage, you can mitigate it by using an online double-...


5

Any side-effect of speculative execution that is visible can be used. There are some (perhaps many) side-effects that don't involve the cache at all. From the Spectre whitepaper: ... In this section we explore potential combinations and conclude that virtually any observable effect of speculatively executed code can potentially lead to leaks of ...


5

This answer is specific to the Spectre Next Generation attacks and will be updated as soon as new information are available. Update, May 22nd: The first patches are coming and so are more information regarding the new vulnerabilities: Intel released this statement on May 21st 2018 which will give you a good overview over Spectre variants 3a and 4. The ...


4

Have you researched the needs of the PHP programmers who want this function? In the practical applications I can think of - verifying passwords, session tokens, etc. the known string would be relatively small, say < 64 bytes; within one Intel cache line. So your trivial implementation would not actually cause different cache access patterns. If you ...


4

If you assume an adversary that can observe memory access patterns through cache leaks then it's silly to try and protect against the adversary learning the length of the secret. He'll always know. The only way to protect against this is to guarantee that you can access past the end of the string without segfaulting - which you almost surely can't without ...


4

This is of course only an example and I'm aware of the possibility to hide the payload in a seemingly correctly designed payload. It's all about making it harder for the bad guys. It's not merely "possible." It's easy. In fact, under HTML5, it is downright trivial. With WebSockets, an HTTP-like connection can tunnel arbitrary content between client-side ...


4

There are several ways to mitigate BREACH effectively, but all of them have trade-offs. In order to understand how these mitigations work, we need to look at how BREACH exactly works: How do I BREACH TLS security? The secret ingredients, according to p. 10 of this presentation on BREACH, are as follows: Compression of the response body A stable page A ...


Only top voted, non community-wiki answers of a minimum length are eligible