Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
邏輯優化的灰色面:針對網頁應用的時序攻擊 (2018臺灣資安大會: 軟體安全論壇)
Search
Yi-Feng Tzeng
March 29, 2018
Technology
1
330
邏輯優化的灰色面:針對網頁應用的時序攻擊 (2018臺灣資安大會: 軟體安全論壇)
一般人對於應用程式的撰寫邏輯與順序,只考量正確性及效能面。但是從灰色的視角切入時,時序或時間差所透露的資訊往往比我們想像中來得多。本議程將針對網頁應用上的時序攻擊,探討邏輯優化可能帶來的安全問題。
Yi-Feng Tzeng
March 29, 2018
Tweet
Share
More Decks by Yi-Feng Tzeng
See All by Yi-Feng Tzeng
重新想像:如何做技術選型決策 / Rethinking : Technical Decision
yftzeng
6
2.3k
擁抱開源:企業應如何善用開源技術,才能得其利而防其弊 - 加強版
yftzeng
0
190
Testing in Production, Deploy on Fridays
yftzeng
0
2.8k
COSCUP 2020 Day 1 - Opening Keynote
yftzeng
0
100
COSCUP 2020 Day 2 - Opening Keynote
yftzeng
0
110
Severless PHP Case : Agile Dashboard via GitLab Board API
yftzeng
0
160
Dev(Sec)Ops: Architecture for Security and Compliance
yftzeng
0
260
給資安工程師開源授權觀念
yftzeng
0
100
Progressive Deployment & NoDeploy
yftzeng
0
180
Other Decks in Technology
See All in Technology
AI時代の経営、Bet AI Vision #BetAIDay
layerx
PRO
1
1.7k
Claude Codeが働くAI中心の業務システム構築の挑戦―AIエージェント中心の働き方を目指して
os1ma
9
1.5k
2時間で300+テーブルをデータ基盤に連携するためのAI活用 / FukuokaDataEngineer
sansan_randd
0
130
恐怖!テストコードなき夜
tsukuboshi
2
110
【OptimizationNight】数理最適化のラストワンマイルとしてのUIUX
brainpadpr
0
130
専門分化が進む分業下でもユーザーが本当に欲しかったものを追求するプロダクトマネジメント/Focus on real user needs despite deep specialization and division of labor
moriyuya
0
970
Vision Language Modelと自動運転AIの最前線_20250730
yuyamaguchi
3
1.1k
ホリスティックテスティングの右側も大切にする 〜2つの[はか]る〜 / Holistic Testing: Right Side Matters
nihonbuson
PRO
0
570
みんなのSRE 〜チーム全員でのSRE活動にするための4つの取り組み〜
kakehashi
PRO
2
140
AI関数が早くなったので試してみよう
kumakura
0
110
【新卒研修資料】数理最適化 / Mathematical Optimization
brainpadpr
25
11k
AIのグローバルトレンド 2025 / ai global trend 2025
kyonmm
PRO
1
120
Featured
See All Featured
A Tale of Four Properties
chriscoyier
160
23k
Designing for humans not robots
tammielis
253
25k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Code Review Best Practice
trishagee
69
19k
Building Applications with DynamoDB
mza
95
6.5k
Optimising Largest Contentful Paint
csswizardry
37
3.4k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
234
17k
The Invisible Side of Design
smashingmag
301
51k
Embracing the Ebb and Flow
colly
86
4.8k
Scaling GitHub
holman
461
140k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
8
750
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
126
53k
Transcript
邏輯優化的灰色面 針對網頁應用的時序攻擊 ( Timing Attacks on Web ) Ant
[email protected]
/
[email protected]
2018-03-13
2/74 Introduction Coding Security Intellectual property Startup • • •
3/74 Thank @mathias for inspiring me
4/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016
5/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016
6/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016
7/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016 1000 µs 1000 µs 100 µs 200 µs
8/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016
9/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016 A000000 B000000 … E000000 EA00000 …
10/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016
11/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016 1000 µs 1000 µs 100 µs 200 µs
12/74 Premature optimization is the root of all evil (
過早最佳化是萬惡的根源 ) ~ Donald Knuth ~ a little bit
13/74 PHP Are PHP functions safe against timing attacks ?
14/74
15/74 DEMO #01
16/74
17/74 Those work on web ideally ?
18/74 localhost
19/74
20/74 Applicaton jitte 10-30 ms Databast jitte 10-300 ms Nttwoek
jitte 100-150 ms
21/74 Attack Shift Timing atack against sofwaet impltmtntaton
22/74 Attack Shift Timing atack against sofwaet impltmtntaton Ideal
23/74 Attack Shift Timing atack against sofwaet impltmtntaton Ideal Timing
atack against busintss logic Reality
24/74
25/74 ~2500 ms
26/74 ~1500 ms
27/74 Login Admin User 100 ms 2500 ms 1500 ms
28/74 Login Admin User 100 ms 2500 ms 1500 ms
~1000 ms
29/74 Login Admin User 100 ms 2500 ms 1500 ms
Validate user 100 ms ~1000 ms
30/74
31/74 100 ms
32/74 100 ms Email guess, brute force attack
33/74 Which one is better ?
34/74
35/74 100 ms
36/74 100 ms 100 ms
37/74 100 ms 100 ms 100 ms
38/74 100 ms 100 ms 100 ms DEMO #02
39/74 100 ms 100 ms 100 ms
40/74 Login Admin User Gender Age VIP 100 ms 2500
ms 1500 ms 1000 ms 1000 ms 1200 ms …... …... Validate user 100 ms
41/74 Welcome Ant ! ~1000 ms
42/74 ~500 ms
43/74 old
44/74 ~30 ms Ref: Front-End Performance The Dark Side @
ColdFront Conference 2016 (p52)
45/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016 (p54) ~15 ms
46/74 Ref: Front-End Performance The Dark Side @ ColdFront Conference
2016 (p50)
47/74 Login Admin User Gender Age VIP 100 ms 2500
ms 1500 ms 1000 ms 1000 ms 1200 ms …... …... Validate user 100 ms
48/74 404 Page not found ~200 ms
49/74 404 Page not found ~80 ms
50/74
51/74 Login Admin User Gender Age VIP 100 ms 2500
ms 1500 ms 1000 ms 1000 ms 1200 ms …... …... Validate user 100 ms 302 / 404 80 ms 1200 ms
52/74
53/74
54/74
55/74
56/74
57/74
58/74 DEMO Online
59/74 Applicaton jitte 10-30 ms Databast jitte 10-300 ms Nttwoek
jitte 100-150 ms
60/74 LAN Router IoT device NAS server / etc. POS
/ Console / etc.
61/74 Login Admin User Gender Age VIP 100 ms 2500
ms 1500 ms 1000 ms 1000 ms 1200 ms …... …... Validate user 100 ms 302 / 404 80 ms 1200 ms
62/74 SuperUser Login Admin User Gender Age VIP 100 ms
100 ms 2500 ms 1500 ms 1000 ms 1000 ms 1200 ms Backdoor …... …... 400 ms Validate user 100 ms 302 / 404 80 ms 1200 ms
63/74
64/74 DEMO #03
65/74 A000000 B000000 … E000000 EA00000 …
66/74 最佳化就像迴旋鏢,何時不小心回來打到你,可能也不知道 ~ Ant ~
67/74 Attack Modes Post-auth Administrator Permissions Hidden page* Pre-auth Hidden
page* Validate user Backdoor Active attacks Passive attacks
68/74 Passive attacks
69/74 Active attacks
70/74 Attack Modes Post-auth Administrator Permissions Hidden page* Pre-auth Hidden
page* Validate user Backdoor Active attacks Passive attacks
71/74 password hash function ?
72/74 password hash function ? DEMO #04
73/74 安全就像洋蔥,一片一片地剝開,總有一片會讓人流淚 ~ Ant ~
74/74
[email protected]
/
[email protected]
https://www.facebook.com/yftzeng.tw https://twitter.com/yftzeng