Time of Check vs. Time of Use (TOCTOU) Attacks

Time of Check vs. Time of Use (sometimes written as TOCTOU or TOC/TOU) is seemingly a very common type of attack that occurs when control information changes between the time the system security functions check the contents of variables and the time the variables actually are used during operations.

Control information is information that is used to make security decisions.

For example, suppose an employee logs onto a system in the morning, remains logged in, and shortly thereafter quits, is fired, or dismissed from the organization.

As a result of the termination, the security administrator removes the user from the user database and disables the account.

However, because the user did not log off, the account still has access to the system and, as far as the system is concerned, still has privileges that the now-unauthorized user could exploit.

Proper deprovisioning of user accounts, as a part of any user change of status (such as termination of their employment), is vital to controlling this risk.

Another example is when a connection between two machines unexpectedly drops. If an attacker manages to attach to one of the ports used for this link before the failure is detected, the invader can hijack the session by pretending to be one of the trusted hosts. Periodic reauthentication can to some extent limit the exposure to this risk.