34

I got a binary file and I'm supposed to crack its password (homework). There was also a function given (a function which is a part of the binary file). That function showed that the input string was compared with the correct password character by character and returned false instantly when a character was wrong (that's not secure way of doing it I guess because it's leaking time and we get an idea of the correct password length as example). But our teacher has added a random timer that returns the result (Correct / Wrong) to make it a little harder for us...

Anyway, I have I already done it successfully with reverse engineering and got the correct password. Now I'm playing with it in the command line:

/usr/bin/time -v ./program_name enter_password

With this command, I get a lot information such as system time, swaps, execution time..But what is most interesting to me is "Voluntary context switches" because the more correct characters of the password I enter, the less "Voluntary context switches" I get!

The more wrong characters I enter, the more "Voluntary context switches" I get.

It took me almost two hours to crack the password just by entering that command, entering characters and observing "Voluntary context switches". Whenever ONE character was correct, the "Voluntary context switches" decreased by one.

My question, what exactly are "Voluntary context switches" and why did they help me cracking the password?

  • 5
    Congratulations on discovering for yourself the rich and still not fully understood field of side-channel attacks. – zwol May 10 '18 at 15:23
  • 1
    @zwol What do you mean by "rich"? And besides, we are currently dealing with side-channel attacks in class, excuse me that I don't have "fully understood" its field that quickly.... – cnmesr May 10 '18 at 15:40
  • 15
    @cnmesr I took it as a sincere comment, not a sarcastic one, saying that zwol considers the field an interesting one since new discoveries are still being made. It's not that you haven't fully understood it, it's that no one fully understands it, and that's what makes it interesting. – hvd May 10 '18 at 15:52
  • 3
    @hvd cnmesr Yes, that's what I meant. – zwol May 10 '18 at 16:01
  • @zwol Oh sorry then! I misinterpreted you and saw it as an attack :p – cnmesr May 10 '18 at 16:05
36

The man page for time explains the concept of voluntary and involuntary context switches:

The resource specifiers [...] are:
   c      Number of times the process was context-switched involuntarily
          (because the time slice expired).
   w      Number of times that the program was context-switched voluntarily, 
          for instance while waiting for an I/O operation to complete.

(quote is from my Debian system, the linked man page has a slightly different text)

That is, a context switch is voluntary, if the process leaves the CPU because it has nothing else to do (while waiting for something external to happen). Involuntary, if it would like to continue some computation, but the OS decides it's time to switch to some other process.


How any of this is related to the password-checking program, depends on what the program actually does.

From the source code linked in the comments, we see that the program calls usleep() once for each non-matching character, continuing the comparison loop on the next character afterwards. Sleeping is about as voluntary as yielding the CPU ever gets, so these calls will show as voluntary context switches for each non-maching character.

On Linux, you should be able to see the calls with strace, too.

The final delay comes from a randomized sleep of T * (rand() % 3), i.e. 0, 1, or 2 times a constant. That's a rather coarse granularity, so it should be easy to average out by doing multiple attempts with the same password.

  • 3
    Here is the source code of the function I mentioned above pastebin.com/iTzheD4u Thank you I will take a look at the calls with strace and hopefully get some more information. About the random timer: If the password has a wrong length, the output time is the same (very very fast) and the random timer doesn't get executed. If the password length is correct, the output is random because random timer is executed. – cnmesr May 10 '18 at 11:44
  • @cnmesr, oh, that's excellent! – ilkkachu May 10 '18 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.