Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

MasterPass.check is vulnerable to timing attacks.

See original GitHub issue

Summary

Timing attacks are a type of side channel attack where one can discover valuable information by recording the time it takes for a cryptographic algorithm to execute.

_.isEqual() does a byte-by-byte comparison of two values and as soon as the two differentiate it terminates. This means the longer it takes until the operation returns, the more correct characters the attacker has guessed.

const match = _.isEqual(global.creds.mpkhash, mpk.hash)

Link to source code: https://github.com/HR/Crypter/blob/master/app/src/MasterPass.js#L23

How can this be fixed?

The following code does not terminate as soon as two bytes are not the same:

var result = 0;
for (var i = 0; i < a.length; ++i) {
  result |= (a.charCodeAt(i) ^ b.charCodeAt(i));
}
return result;

Issue Analytics

State:
Created 7 years ago
Comments:5 (3 by maintainers)

Top GitHub Comments

1reaction

HRcommented, Jan 15, 2017

Issue fixed!

1reaction

EdOverflowcommented, Jan 15, 2017

Your implementation solves this issue perfectly.

Top Results From Across the Web

Timing Attacks Have Never Been So Practical - YouTube

by Nethanel GelernterCross-site search (XS- search ) is a practical timing side-channel attack that allows the extraction of sensitive ...

What is a Timing Attack Vulnerability?

In a timing attack, the attacker gains information that is indirectly leaked by the application. This information is then used for malicious purposes,...

Timing Attacks Have Never Been So Practical

Agenda – practical timing attacks. • Cross-site search (XS-search) attacks &. Response inflation ... the challenge is to find all the vulnerable spots....

Introduction to Timing Attacks!

A timing attack is a security exploit that enables an attacker to spot vulnerabilities in a local or a remote system to extract...

Developer security best practices: protecting against timing ...

In this article, we're going to take a look at timing attacks. Timing attacks are a particular type of attack that exploits flaws...