Later archive addition

The ND2DB Attack: Database Content Extraction Using Timing Attacks on the Indexing Algorithms

Ariel Futoransky, Damián Saura and Ariel Waissbein

Ordinary INSERT privileges are enough to read indexed private columns. B-tree node splits take measurably longer than plain inserts, so a divide-and-conquer search over the key space recovers neighbouring values. Demonstrated against MySQL-InnoDB: a 64-bit key in about ten minutes and ten thousand inserts.

Record

Researcher

Ariel Futoransky, Damián Saura and Ariel Waissbein

Format

Whitepaper

In the archive

• Added to the 2007 archive after the original list was published

Related sources

• Black Hat paper

Tags

• timing-attack
• side-channel
• database
• mysql
• info-leak

This page is the archive's own catalogue record. The research is the work of Ariel Futoransky, Damián Saura and Ariel Waissbein, first published at the original source. Preserved copies are kept so the citation survives its host.