You have the whitepaper documenting the methods.
Documenting a theorized situation and actual practical implementation are two very different things.
I really can't help you beyond that, it's not as though I can provide a link for you to click that will instaprove I did this.
And I have no desire to imply you are being less than truthful. However, your attempt was clearly with the approval and involvement of the owner/administrator of the target system, very likely present at the target system itself, or at the very least logged on opening the door for you to render exploitation.
It is more complex than a point and click attack though. These attacks really only leak data you'd not otherwise know. On it's own, that won't escalate privileges, but there are plenty of other exploits to chain with that that will.
Of course.
At the end, it needs human involvement. If that's what you mean by physical access, 100% agree.
I've spent time over the past few days to further research how this and the other side-channel type vulnerabilities can be exploited and a few things have been made very clear;
1. No known attack(successful or otherwise, proof of concept or otherwise) has been
documented thus far.
2. While in theory a remote attack is possible, circumstances have to be so very perfect(or be made so) as to be virtually impossible without human input at the target system.
3. Given the difficulty involved, attacks most certainly will require a degree of physical presence at the target system.
4. While the average user is unlikely to have the high levels of security measures implemented that one would find on a business/enterprise system, average users generally do not use the entry points required to render an attack, thus making them effectively protected anyway.
5. Average users, even those targeted by criminal investigations, do not have information valuable enough to justify the difficulty involved in a remote attack attempt(though in practical terms, physical access would be far easier to achieve, assuming such access would be lawful).
6. Rendering attack against power users, such as many of us here at TPU who take personal security very seriously, would make any attempt so extremely unlikely that success is effectively impossible.
7. Attempts will be noticed. An attacker will get 2, maybe 3, attempts before the actions taken to effect such attack will be noticed.
While technically possible, remote exploitation of these types of vulnerabilities is so, ironically, remote as to be effectively impossible without some level of human presence at the target system.
