Which timing-based attack uses the browser to send crafted requests from the user's browser via JavaScript?

Which timing-based attack uses the browser to send crafted requests from the user's browser via JavaScript?

• A. Browser-based Timing Attack
• B. Cross-site Timing Attack
• C. Direct Timing Attack
• D. Web-based Timing Attack

Answer: (B)

The concept being tested is a timing attack that relies on the victim’s browser to act as the intermediary, using JavaScript to issue crafted requests to a target site and measure how long those responses take to infer information. This is a cross-site timing attack, because it specifically involves the user’s browser making requests to a site from another origin and observing timing differences to learn something about the target (such as authentication state or resource existence). The browser, via JavaScript, serves as the attack vector, which is what distinguishes this from attacks that are conducted directly from the attacker’s environment or are described in vague terms. A generic browser-based timing attack or a web-based timing attack wouldn’t necessarily emphasize the cross-origin, user-browser request aspect that facilitates cross-site information leakage.

The concept being tested is a timing attack that relies on the victim’s browser to act as the intermediary, using JavaScript to issue crafted requests to a target site and measure how long those responses take to infer information. This is a cross-site timing attack, because it specifically involves the user’s browser making requests to a site from another origin and observing timing differences to learn something about the target (such as authentication state or resource existence). The browser, via JavaScript, serves as the attack vector, which is what distinguishes this from attacks that are conducted directly from the attacker’s environment or are described in vague terms. A generic browser-based timing attack or a web-based timing attack wouldn’t necessarily emphasize the cross-origin, user-browser request aspect that facilitates cross-site information leakage.