Hacker News Reader

I'm not even sure code execution is strictly necessary for this style of attacks.

An attacker could carefully craft network packets to force the control flow of existing software to manipulate the CPU state. They could and then use the timing differences in network packets to read data out.

Would be painfully slow, but theoretically possible.

View on HN

A while a go there was a post on here describing exactly that. I can't find it anymore unfortunately (maybe someone else has it?), but judging from my memory of that discussion this should be doable-ish.

But if you're just running a local home system the chances of being targeted with such an unreliable attack are virtually zero.

I don't think this is correct. The timing attacks here all require extremely high resolution timers, and network + I/O latency would obscure the variance entirely.

People are able to crack poor password comparison implementations over a jittery, latency heavy network. It’s possible to get almost arbitrarily high resolution when doing timing side channel attacks, you’ll just need many more samples.

Reply on news.ycombinator.com