tylerni7

because we're a company and we want to make money to continue to fund cool research, and help our customers secure their software :)

yeah... definitely a bit of a rush to get the landing page out after a long time in the disclosure process. The folks putting this all together have been working like mad (finding the bug, disclosing, working a lot on patching, writing up POCs and verifying exploitability in different scenarios) and stayed up really late to finish up the landing page, which led to a lot of minor issues.

But the bug is real and people should patch :)

For the size: sometimes people will shove in kilobytes of offset tables or something into an exploit, so it'll fingerprint and then look up details to work. This is much smaller because it doesn't need any of that, which is important for severity. (I agree the "golf" nature is a bit of an aside, kind of like pwn2own exploits taking "10 seconds")

ugh sorry should be fixed. There was some scrambling to get more info together to explain the issue (and yes, obviously marketing), so there are some minor mistakes. Thanks for pointing it out!

The main protocol is called NTRIP. Lots of sources make it available (though it might be annoying to stream from ~250 simultaneously, not sure). There's a lot if you search that term though.

I think GEONET (the Japanese data source) might have some NTRIP casters. Also some in Korea and elsewhere. Sometimes you have to pay for access though, so I need to look more.

Thanks! It's mostly just been for fun, lots of academic work has already shown the principles of it.

I'm glad folks are looking at it, and enjoying it! If you have questions or anything let me know! :)

Oh hey I wrote this!

Yeah, we had a detector with some ML stuff, it worked okay, but the main issue is there isn't much training data.

Overall the false positives are quite low (visually, which is hand wavey, of course). I've not really seen a big event that was not real. I ran it for a while 24/7 and while there are "scintillations" there aren't any circular waves. False negatives are a much bigger issue. Something like an IRBM or SRBM doesn't really show up, and those are much more common.

Fwiw, this uses a bandpass filter to look for the ripples, which filters out a ton of noise. Looking at ionospheric depletion would be good and probably more sensitive, but it requires accurate models of what the ionosphere ought to do. I've tried a few things there with mixed results.

:) Thanks for posting! I made this (the blog post/narrated the videos).

Some folks asked, so I also uploaded the source for the challenges in the videos: https://github.com/ForAllSecure/c2c-rapidfire-challenges

Just so everyone knows, this specific attack is rather old. Modern versions of the RSA algorithm use blinding to specifically prevent this, which causes the RSA calculations to effectively be performed on random data.

There has also recently been a published timing attack regarding elliptic curve signatures, and there are some older papers about AES's vulnerability to timing attacks due to cache misses when using S-boxes. So while this paper specifically isn't a viable attack today, it is still relevant.