What is Observable Timing Discrepancy (CWE-208)?

TL;DR: Observable Timing Discrepancy (CWE-208) is a vulnerability where separate operations reveal security-relevant information through timing differences, and can be fixed by ensuring consistent response times.

What is Observable Timing Discrepancy?

Observable Timing Discrepancy (CWE-208) is a type of vulnerability where separate operations in a product reveal security-relevant information through timing differences. As defined by the MITRE Corporation under CWE-208, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Observable Timing Discrepancy occurs when different operations within an application take varying amounts of time to complete, revealing sensitive information about the system’s state. This can lead to unauthorized access or data breaches if attackers measure these differences accurately. Jump to: What is Observable Timing Discrepancy? · Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework Fixes · AI Check · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Observable Timing Discrepancy Overview · How Observable Timing Discrepancy Works · Business Impact of Observable Timing Discrepancy · Observable Timing Discrepancy Attack Scenario · How to Detect Observable Timing Discrepancy · How to Fix Observable Timing Discrepancy · Framework-Specific Fixes for Observable Timing Discrepancy · How to Ask AI to Check Your Code for Observable Timing Discrepancy · Observable Timing Discrepancy Best Practices Checklist · Observable Timing Discrepancy FAQ · Vulnerabilities Related to Observable Timing Discrepancy · References · Scan Your Own Site

Observable Timing Discrepancy Overview

What: Observable Timing Discrepancy (CWE-208) is a vulnerability where separate operations in an application reveal security-relevant information through timing differences. Why it matters: Attackers can exploit these discrepancies to infer sensitive information about the system’s state, leading to unauthorized access and data breaches. Where it occurs: In web applications and network protocols. Who is affected: Developers and administrators of systems with observable timing discrepancies. Who is NOT affected: Systems that ensure consistent response times regardless of input or state.

How Observable Timing Discrepancy Works

Root Cause

The root cause lies in the fact that different operations within an application take varying amounts of time to complete, revealing sensitive information about the system’s state through timing differences.

Attack Flow

1. An attacker measures the response times for similar operations under various conditions.
2. The attacker identifies discrepancies in execution times.
3. Based on these discrepancies, the attacker infers security-relevant information about the system’s state.

   Prerequisites to Exploit

   • Different operations must take varying amounts of time to complete.
   • Attackers need access to measure response times accurately.

     Vulnerable Code

     ```python def check_user_exists(user_id): start_time = time.time() result = db.query(“SELECT * FROM users WHERE id = ?”, (user_id,)) end_time = time.time()

   if not result: return False

   elapsed_time = end_time - start_time print(f”Elapsed Time: {elapsed_time}”)

   return True

   This code measures the execution time of a database query and prints it, revealing whether a user exists or not based on response times.
   ### Secure Code
   ```python
   def check_user_exists(user_id):
    result = db.query("SELECT * FROM users WHERE id = ?", (user_id,))
       
    if not result:
        return False
   
    random_delay = random.uniform(0.1, 0.5)
    time.sleep(random_delay)
   
    return True
   

   This code ensures consistent response times by introducing a random delay after the database query, masking any timing discrepancies.

Business Impact of Observable Timing Discrepancy

Confidentiality

• Reveals whether specific operations were successful or not.

  Integrity

• None directly impacted.

  Availability

• None directly impacted. Real-world business consequences:
• Financial losses from data breaches.
• Compliance penalties for security failures.
• Damage to reputation due to disclosed vulnerabilities.

Observable Timing Discrepancy Attack Scenario

1. An attacker measures the response times of a user authentication endpoint under various conditions.
2. The attacker identifies discrepancies in execution times when successful and unsuccessful login attempts are made.
3. Based on these discrepancies, the attacker infers whether specific users exist or not.

How to Detect Observable Timing Discrepancy

Manual Testing

• Measure response times for similar operations under different conditions.
• Compare results to identify inconsistencies.
• Check if random delays can mask timing differences.

  Automated Scanners (SAST / DAST)

  Static analysis can detect code patterns that measure execution time, while dynamic testing is needed to confirm actual discrepancies in a running application.

  PenScan Detection

  PenScan’s scanner engines such as ZAP and Nuclei can identify potential observable timing discrepancies by analyzing response times under various conditions.

  False Positive Guidance

  A real finding will show consistent differences in response times for similar operations, while false positives may arise from normal variations due to network latency or server load.

How to Fix Observable Timing Discrepancy

• Ensure all operations take the same amount of time regardless of input or state.
• Use constant-time algorithms and random delays to mask timing discrepancies.

Framework-Specific Fixes for Observable Timing Discrepancy

Python/Django

def check_user_exists(user_id):
    result = db.query("SELECT * FROM users WHERE id = ?", (user_id,))
    
    if not result:
        return False

    random_delay = random.uniform(0.1, 0.5)
    time.sleep(random_delay)

    return True

This code ensures consistent response times by introducing a random delay after the database query.

How to Ask AI to Check Your Code for Observable Timing Discrepancy

Observable Timing Discrepancy Best Practices Checklist

• Ensure all operations take the same amount of time regardless of input or state.
• Use constant-time algorithms to mask timing discrepancies.
• Introduce random delays after sensitive operations.

Observable Timing Discrepancy FAQ

How does an observable timing discrepancy work?

An observable timing discrepancy occurs when separate operations in a product reveal security-relevant information through differences in execution time.

What is the impact of Observable Timing Discrepancy on web applications?

It can lead to unauthorized access and data breaches by revealing whether certain actions were successful or not based on response times.

How do attackers exploit observable timing discrepancies?

Attackers measure differences in execution time to infer sensitive information about the system’s state, such as whether a specific operation succeeded.

What are some common signs of an Observable Timing Discrepancy vulnerability?

Signs include inconsistent response times for similar operations and variations in server load when performing certain actions.

How can I prevent observable timing discrepancies in my code?

Ensure that all operations take the same amount of time regardless of input or state, using techniques like constant-time algorithms.

What are some best practices to mitigate Observable Timing Discrepancy vulnerabilities?

Implement consistent response times and use random delays to mask variations in execution time.

How can I test for observable timing discrepancies in my application?

Use tools that measure response times under different conditions and compare results to identify inconsistencies.

Vulnerabilities Related to Observable Timing Discrepancy

| CWE | Name | Relationship | |—|—|—| | CWE-203 | Observable Discrepancy | ChildOf | | CWE-385 | Covert Timing Channel | CanPrecede | | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | CanPrecede |

References

• MITRE: CWE-208
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Observable Timing Discrepancy and other risks before an attacker does.