Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches
نویسندگان
چکیده
Recent work on cache attacks has shown that CPU caches represent a powerful source of information leakage. However, existing attacks require manual identification of vulnerabilities, i.e., data accesses or instruction execution depending on secret information. In this paper, we present Cache Template Attacks. This generic attack technique allows us to profile and exploit cachebased information leakage of any program automatically, without prior knowledge of specific software versions or even specific system information. Cache Template Attacks can be executed online on a remote system without any prior offline computations or measurements. Cache Template Attacks consist of two phases. In the profiling phase, we determine dependencies between the processing of secret information, e.g., specific key inputs or private keys of cryptographic primitives, and specific cache accesses. In the exploitation phase, we derive the secret values based on observed cache accesses. We illustrate the power of the presented approach in several attacks, but also in a useful application for developers. Among the presented attacks is the application of Cache Template Attacks to infer keystrokes and—even more severe—the identification of specific keys on Linux and Windows user interfaces. More specifically, for lowercase only passwords, we can reduce the entropy per character from log2(26) = 4.7 to 1.4 bits on Linux systems. Furthermore, we perform an automated attack on the Ttable-based AES implementation of OpenSSL that is as efficient as state-of-the-art manual cache attacks.
منابع مشابه
Secure Hierarchy-Aware Cache Replacement Policy (SHARP)
In cache-based side channel attacks, a spy that shares a cache with a victim probes cache locations to extract information on the victim’s access patterns. For example, in evict+reload, the spy repeatedly evicts and then reloads a probe address, checking if the victim has accessed the address in between the two operations. While there are many proposals to combat these cache attacks, they all h...
متن کاملImproving Confidentiality Against Cache-based SCAs
Side channels and covert channels can give untrusted applications access to the trusted and sensitive data in order to retrieve private information.. In this poster, we present a countermeasure called the Smartflush against cache-based Side Channel Attacks (SCAs). The Smartflush is a quick-patch countermeasure proposed to counter timing attacks that exploit inclusive caches in Intel’s x86 archi...
متن کاملARMageddon: Cache Attacks on Mobile Devices
In the last 10 years cache attacks on Intel CPUs have gained increasing attention among the scientific community. More specifically, powerful techniques to exploit the cache side channel have been developed. However, so far only a few investigations have been performed on modern smartphones and mobile devices in general. In this work, we describe Evict+Reload, the first access-based cross-core ...
متن کاملBypassing Scheme for Inclusive Last Level Caches
The design of an effective last level cache(LLC) continues to be an important issue in processor‘s performance. Recent works on high performance caches have shown that cache bypassing is an effective technique to enhance the performance of last level caches. However, commonly used inclusive cache hierarchy cannot benefit from this technique because bypassing inherently breaks the inclusion prop...
متن کاملFlush+Flush: A Stealthier Last-Level Cache Attack
Research on cache attacks has shown that CPU caches leak significant information. Proposed detection mechanisms assume that all cache attacks cause more cache hits and cache misses than benign applications and use hardware performance counters for detection. In this article, we show that this assumption does not hold by developing a novel attack technique: the Flush+Flush attack. The Flush+Flus...
متن کامل