OverTime: Remote Timing Attacks Against IoT Devices
summary
Claims that slow‑clock IoT devices yield exploitable timing side channels and demonstrates a working toolchain: UDP server on an Arduino Uno (16 MHz) with a 100 Mbps Ethernet shield, user‑space + kernel timestamps and hardware NIC timestamps to cut noise, plus differential‑pair measurements and basic ML/box‑test stats. Results show remote distinguishability at ~1 µs (100 ns on LAN), a reduction of an 8‑digit PIN search from ~100M to ~1–2M guesses, and end‑to‑end extraction in minutes.
AI-written summary · about
chapters (12)
- 0:00Introduction to timing attacks
- 1:39Analyzing string comparison
- 4:49Precision, accuracy, and noise
- 7:57Statistical analysis basics
- 10:24Challenges of remote timing
- 13:29Targeting embedded systems
- 17:10Evaluating different platforms
- 21:29Noise reduction techniques
- 25:28Data collection and evaluation
- 29:50Differential pair estimation
- 34:24Time sources and measurement
- 37:56Hardware-level timestamping
related talks
32mCommon Attacks on IoT Devices
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets
50mTime Trial: Racing Towards Practical Timing Attacks
11mReal-Time Compromise: Investigating RTC Security in Consumer IoT
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors
01h 10mAttacking IoT Telemetry
41mHand Me Your SECRET, MCU! Microarchitectural Timing Attacks on Microcontrollers are Practical
28mThe IoT Hacker's Toolkit