I get that timing attacks are reproducible in test environments and in a theoretical sense, but have any major real-life attacks been based on a timing vulnerability? Most websites anyone would want to attack will be running off of multiple servers (which will be reading from replicated mysqls, parts of the requests will likely be memcached, the load balancers will likely have fluctuating load etc. etc.), even multiple data centers. The number of requests you'd have to observe before you could have any statistically meaningful information would be huge. And we're talking about sub-millisecond differences (even Google routinely serves pages in the 50ms range, so this difference is tiny).
Seems like other, more traditional problems (weak / poor crypto, social engineering) are much more important problems.
I kind of wonder if people just really like timing attacks because they're so easy to understand, and, once you spot them, so easy to fix.
Crosby et al. conclude:
We have shown that, even though the Internet induces significant timing
jitter, we can reliably distinguish remote timing differences as low as
20µs. A LAN environment has lower timing jitter, allowing us to reliably
distinguish remote timing differences as small as 100ns (possibly even
smaller). These precise timing differences can be distinguished with
only hundreds or possibly thousands of measurements.
If you'd like to bet that this sort of statistical analysis will get harder to perform over time, I'll take your wager. I'm not willing to wait until someone is publicly compromised before I fix security vulnerabilities—I do not work for an employer who's willing to tolerate a few break-ins before fixing the locks.
I'd also argue that a) a timing attack vulnerability is "weak/poor crypto," b) I don't need to write about the importance of other attack vectors (XSS, CRSF, social engineering, telepathy, bats, etc.) while writing about timing attacks, and c) if timing attacks are easy to understand and fix there would be less of them.
Seems like other, more traditional problems (weak / poor crypto, social engineering) are much more important problems.
I kind of wonder if people just really like timing attacks because they're so easy to understand, and, once you spot them, so easy to fix.