Can You Tell Me the Time? Security Implications of the Server-Timing Header
Vik Vanderlinden, Wouter Joosen, Mathy Vanhoef · 2023
Performing a remote timing attack typically entails the collection of many timing measurements in order to overcome noise due to network jitter.If an attacker can reduce the amount of jitter in their measurements, they can exploit timing leaks using fewer measurements.To reduce the amount of jitter, an attacker may use timing information that is made available by a server.In this paper, we exploit the use of the server-timing header, which was created for performance monitoring and in some cases exposes millisecond accurate information about server-side execution times.We show that the header is increasingly often used, with an uptick in adoption rates in recent months.The websites that use the header often host dynamic content of which the generation time can potentially leak sensitive information.Our new attack techniques, one of which collects the header timing values from an intermediate proxy, improve performance over standard attacks using roundtrip times.Experiments show that, overall, our new attacks (significantly) decrease the number of samples required to exploit timing leaks.The attack is especially effective against geographically distant servers.Coordinated Disclosure: We have disclosed our findings to the authors of the W3C Working Draft and have also contacted Shopify to warn them about the possible security risks of using the server-timing header. II. BACKGROUNDWhen timing attacks were introduced two and a half decades ago by Kocher in 1996, most of these attacks were aimed at exploiting cryptographic implementations to extract Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb) 2023