Clocks Have Ears: Timing and Browser-Based Local Network Port Scanner

In this presentation on the DEF CON 31 Main Stage, researcher Donny Kim presents "Clocks Have Ears," revealing how high-resolution browser timing APIs can be weaponized to perform stealthy local network port scans directly through client-side JavaScript. He opens at 03:03 by explaining how measuring precise execution intervals with window.performance.now() during fetch() requests exposes internal network topology without triggering Same-Origin Policy (SOP) blocks.

Donny analyzes network timing signatures at 06:03, demonstrating that closed ports on local hosts reject TCP packets within fractions of a millisecond, whereas open ports or filtered IP addresses experience measurable delays or timeouts. At 09:04, he presents empirical timing graphs establishing 50-millisecond detection thresholds across private subnets (10.0.0.1, 192.168.1.1). At 15:00, he demonstrates a working web-based port scanner that maps local services (AirPlay, Discord RPC) within minutes, concluding at 17:00 with browser security defenses including timer quantization and Private Network Access (PNA) specifications. (AI summary — Gemini Flash)