Schneier on Security

Clive Robinson • March 18, 2021 4:47 PM

@ ALL,

Am I the only one thinking,

“Why has it taken so long to come up with an exploit”?

The fact that all time based side channels can be exploited in one way or another to leak either secrets or identification of the system or user, you would have thought would have encoraged students and similar to develop POC code and publish a paper.

As a time line the first big example of using the cache to leak the AES key across the network just a couple of weeks after the finalist was finalised would have woken people up a bit.

Then the research involving identifing that different host interfaces in a system by TCP timeing and the system clock drift. Again you would have thought would also wake people up.

We’ve been “Sleepwalking” into this problem and to be honest I get the feeling the industry has become almost entirely apathetic about it.

After all it’s not a problem that can be solved by an application. Becsuse the root cause is way further down the computing stack than the CPU layer let alone it’s ISA layer.

Like all “bubbling up attacks” it can not be solved by top down coding, it needs appropriate hardware in place. But Intel have made it brutally clear they care not a jot in real secure hardware design, because it would make those “oh so important specs look bad”.

As I’ve indicated for more than a decade or so these hardware securiry issues and their solution have been known for many decades and they were not that difficult to implement even back in the 1960’s.

Clive Robinson • March 19, 2021 5:27 AM

@ ALL,

With regards my earlier comment of,

“Then the research involving identifing that different host interfaces in a system by TCP timeing and the system clock drift.”

First came up on this blog back in early March 2005,

https://www.schneier.com/blog/archives/2005/03/remote_physical.html/#comment-3050

Then at the begining of September 2006 a year and half later, Steven J. Murdoch over at the Cambridge Computer labs, came up with,

“Hot or Not: Revealing Hidden Services by their Clock Skew”,

https://www.lightbluetouchpaper.org/2006/09/04/hot-or-not-revealing-hidden-services-by-their-clock-skew/

Whilst Steven used it to demonstrate finding services hidden behind Tor, I’d been thinking about to me a more interesting attack.

If you are a high end researcher into zero-day vulnerabilities you will know how valuable they can be in terms of time and other resources invested in finding new ones. You will also know that one of the ways such zero-day attacks become “Known and Negated” back then was “Honey Pots”.

So as an attacker how do you find out if the IP address range you are just about to go and “tap up” is actually real individual machines, or just one machine pretending to be a network of machines and is in fact a “Honey Pot” part of the “Honeynet Project” aimed at capturing things like freshly minted zero-days?

Well the problem for a “honey pot” is no matter how many hosts it fakes it still has only one master CPU clock… Thus measuring the clock drift is one good way to do it.

However Steve Murdoch’s original system was both very noisy and inefficient. He used many many probes across a given time period which would show up in the Honey Pot logs. Also as any comms engineer who knows what an “eye diagram” is will tell you all the timing information is in the clock edges. Which translates to when the TCP time stamp rolls over in the attack. So any proabs not at that time are wasted as they provide no usefull information –out side of initial syncing– and fill the logs up.

So by using a two stage approach of first “halve the difference” to obtain sync then just a few probes across the time of the expected TCP time stamp transition will give you an effective tracking loop (as are used in many Spread Spectrum and data receivers).

This still will leave traces in the Honey Pot log though… How to deal with that?

Well you can not stop them getting logged, so make them hide in amongst “expected traffic” and use the Honey Pot operators assumptions work against them. In short a little bit of “social engineering”. The way I chose to prototype this was to make the attack look like “A brain dead Script Kiddy Attack” which were very numerous back then.

The result is the chances were that the Honey Pot logs like todays IDS log watching processes would “note, classify, filter and ignore”. Thus as an attacker with a nice shiny new zero-day you would find the Honey Pot and thus ignore it thus your zero-day would be like the butterfly that escapes the lepidopterists net, fomalin jar, and being pined to a cork on public display.

But there is another use for the time stamp attack, which brings us back to cache attacks.

Mad as it might first appear from a security perspective people share computers in data centers to reduce costs of running an Internet connected service. Most such shared services are just like the Honey Pot machines but rented out from server farms and some Cloud Servers…

Many cache attacks require a probe on the machine they are trying to detect secrets such as AES keys etc leaking from via time based side channels.

Using a TCP Time Stamp attack would give information about what other services share the machine of interest, thus increase your chances of finding a way to mount a probe.

All of this was either known or easily worked out more than a decade and a half ago.

In times past I used to find that attacks I thought up would take about eight years to becoming found in the wild…

So “Why So Long?” this time…

Is it because the entire ICTsec industry has slowed down? Become inefectual? Lacks investment? Has become filled with snake oil salesmen?

I have commented on a number of occasions that in ICTsec “We fail to learn from our history” with attack methods and even attacks getting “re-cycled” every few years, so that “What was old is new again” like skinny leg jeans.

I’ve also noted that due to the failures of the big corporates our consumer grade Hardware, OS’s and Apps have more holes than “moth eaten string ubderpants” thus in the process of letting everyone down make the entire LAN, WAN, and Internet connrcted structure a very very “target rich environment” for attackers.

Thus is it just that modern attackers are so few in comparison that they are in effect “living off the fat of the land” with low hanging fruit and windfalls, thus have no real need to strive? To inovate? To learn, grow and evolve?