Explore the evolving landscape of timing attacks in web security through this 42-minute conference talk from AppSecEU 2016 in Rome. Delve into various timing attack concepts, including the Drunkenness Timing Attack and its experimental results. Examine web-based timing attacks, their relationship to the Same-Origin Policy, and classic cross-site timing attacks. Investigate browser-based timing attacks, such as the Video Parsing Attack, Cache Storing Attack, and Age-discovery Attack. Learn about additional attack vectors, mitigation strategies, and engage in a Q&A session to deepen your understanding of this critical aspect of application security.
The Timing Attacks They Are A-Changin' - Web-based and Browser-based Timing Attack Techniques
Overview
Syllabus
APPSEC EUROPE
TID TIMING ATTACKS
Timing Attack Concept
Drunkenness Timing Attack
The Experiment Part 2
Web-based Timing Attacks
Same-Origin Policy
Classic Cross-site Timing Attacks
Browser-based Timing Attacks
Video Parsing Attack
Cache Storing Attack
Age-discovery Attack
Moar Attacks
Mitigation
Conclusion
Questions?
Taught by
OWASP Foundation
Related Courses
-
I Know Where You've Been - Geo-Inference Attacks Via The Browser Cache
-
Pixel Perfect Timing Attacks with HTML5
-
Security Implications of Cross-Origin Resource Sharing - HTML5 and CORS Analysis
-
Timing Attacks Have Never Been So Practical - Advanced Cross-Site Search Attacks
-
Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers
-
Clocks Have Ears - Timing and Browser-Based Local Network Port Scanner
