> OK all this theory is all very well, but while I have seen claims that this is
> being exploited in the wild, I've not found anything that supports that claim.
You may be right that there isn't a prepackaged exploit tool, which
leaves this to advanced hackers. White hats have made the most visible
use of the exploit in attempting to prove that it's practical, with
gradually improving results. Padraic blogged that real-world evidence
was "thin" in late 2010, and I don't know if he has an update.
Still, that's why we fix things that have only been proven in the lab;
just because you use a testing environment doesn't mean it's
contrived.
> The Firebird developers basically say that there is no possibility of
> exploitation on their own hash comparisons and dispute that this is a practical
> hack method. So what practical exploits do exist?
Well, it may not be possible to attack Firebird, but that isn't the
point.
Also don't forget that authentication-related strings like session IDs
may be compared on the application side. Session IDs are the implied
target here in Coda Hale's blog: http://codahale.com/a-lesson-in-timing-attacks/.
-- S.