Racing Towards Practical Timing Attacks

Explore the practical implications of timing side-channel attacks in web applications through this 50-minute Black Hat conference talk. Delve into the detection and exploitability of timing vulnerabilities in common scenarios, including database queries, message authentication codes, web API keys, OAuth tokens, and login functions. Learn about the 'time trial' tool and gain insights into measuring timing differences remotely across various network environments. Understand the significance of these attacks for defensive security, penetration testing, and research roles. Examine experimental results demonstrating precise timing measurements and their distinguishability in modern web frameworks and servers. Gain a comprehensive update on the state-of-the-art in exploiting timing attacks and evaluate their severity and impact on web application security.