Tricky Web Timing Attacks Are Getting Easier to Use—and Abuse

Researchers demonstrated that web timing attacks—refinements of the “timeless timing” approach over HTTP/2—are practical and can reliably leak information useful to attackers. By reducing network and server noise and validating techniques against a 30,000-site testbed, the work shows these timing methods can reveal server-side injection flaws and misconfigured reverse proxies, increasing the feasibility of exploitation across many web applications.