What is the most simple and effective way to Prevent the Timing attacks for the programmers who use PHP?
I'm a high school student, I'm new to programming and I've been learning Security since few weeks. I know Blind and Time based SQL Injection attacks and I know how are they performed and How we can prevent them. But, in this page of PHP docs explains that comparison of passwords is also vulnerable to timing attacks (when using '==' operator).
I considered that anything written in the backend of the server with PHP is safe from Client Side Perspective but here is the case totally different. The hackers can take advantage of indirect methods and guess the backend and try to exploit it. Since there are not many tutorials, stuff, information to read about how timing attacks can be performed against the PHP script which performs the comparison of 2 strings, I want to know the things to keep in mind to prevent those kinds of attacks.
I want you to answer these questions.
If I compare hashes with md5, then will it be applicable? (practical perspective).
What is the best thing here I can do to prevent it?
A short tutorial/script to demonstrate that how timing attacks work.
1) An MD5 timing attack is equal to the difficulty of a plaintext timing attack, plus an MD5 rainbow table attack. Just use a normal timing attack to figure out the first 8-10 bits of the MD5 (Generating strings whose MD5s have a specific 8-10 bit sequence is easy). Then rainbow table match on those first 8-10 bits to get a small set of passwords. Then bruteforce those passwords.
2) Anything where checking is related to time. An example would be a complex SQL query. If you use an SQL DB to check the first input, and then another query to check the second input, then the attacker could use a timing attack to check the validity of the first input before guessing the second input.
3) Your for loop should loop over all of the characters of the correct answer, without exiting if an incorrect character or input length is found. Compilers might optimize this so you might want to make sure side effects are generated from this comparison that the compiler can't optimize.
4) No, not at all. If your PHP script does any system call at all, it will immediately make a string comparison negligibly short. Where the variance in string comparison times is hundreds or thousands of times less than any other variance. Just write random numbers to a file at the end of the script and a timing attack is impossible. Also, if it over the internet, a timing attack is incredibly infeasible. Internet times span hundreds of milliseconds and sometimes even seconds. String comparisons are in the low microseconds if not nanoseconds.
You can of course put the time = Xms, while, log("Xth character") bit in a function and then for loop over guess.length. This is most useful when you're on the same system and attacking a linux binary that's meant for admins, since you have excellent timing precision. A famous example of timing attacks were Meltdown and Spectre, which use CPU cache timings to exploit data (Correct guesses are instant, while cache misses take a bit).
Not the answer you're looking for? Browse other questions tagged php exploit attacks attack-prevention timing-attack or ask your own question.
Should I worry about remote timing attacks on string comparison?
Are there any working proof-of-concept string comparison timing attacks?
Timing attack against HMAC in authenticated encryption?
Cross-language primitives against string comparison timing attacks?
Is PHP loadXML vulnerable to XXE attack (and to other attacks)? Is there a list of vulnerable functions?
Is DNSSEC vulnerable to (remote) timing attacks?
Execute an uploaded php script on a vulnerable server if I know it's location?