ASLR on the Line: Practical Cache Attacks on the MMU

Gras, Ben; Razavi, Kaveh; Bosman, Erik; Bos, Herbert; Giuffrida, Cristiano

doi:10.14722/ndss.2017.23271

Cited by 169 publications

(177 citation statements)

References 41 publications

Supporting

Mentioning

177

Contrasting

Order By: Relevance

“…In both attacks, the attacker manipulates the state of the cache and later on checks whether the state has changed. Besides attacks on cryptographic implementations [34], [55], these attack primitives can also be used to defeat ASLR [13] or to build covert-channels [22].…”

Section: A Microarchitectural Attacksmentioning

confidence: 99%

“…ArrayBuffers are used in the same way as ordinary arrays but are faster and more memory efficient, as the underlying data is actually an array which cannot be resized [26]. If one virtual address within an ArrayBuffer is identified, the remaining addresses are also known, as both the addresses of the memory and the array indices are linear [14], [13].…”

Section: B Microarchitectural and Side-channel Attacks In Javascriptmentioning

confidence: 99%

“…Since their work, a series of microarchitectural attacks have been mounted from websites, such as page deduplication attacks [14], Rowhammer attacks [15], ASLR bypasses [13], and DRAM addressing attacks [40].…”

Section: Introductionmentioning

confidence: 99%

“…Although JavaScript code runs in a sandbox, Oren et al [33] demonstrated that it is possible to mount cache attacks in JavaScript. Since their work, a series of microarchitectural attacks have been mounted from websites, such as page deduplication attacks [14], Rowhammer attacks [15], ASLR bypasses [13], and DRAM addressing attacks [40].…”

Section: Introductionmentioning

confidence: 99%

“…However, these countermeasures are incomplete as they do not cover all sensors and are circumventable [13], [40].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Schwarz

Lipp

Gruss

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and sidechannel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks. I. INTRODUCTIONOver the past 20 years, JavaScript has evolved to the predominant language on the web. Of the 10 million most popular websites, 94.7 % use JavaScript [54]. Dynamic content relies heavily on JavaScript, and thus, most pages use JavaScript to improve the user experience, using, e.g., AJAX and dynamic page manipulation. Especially for platform-independent HTML5 applications, JavaScript is a vital component. Microarchitectural attacks can also be implemented in JavaScript, exploiting properties inherent to the design of the microarchitecture, such as timing differences in memory accesses. Although JavaScript code runs in a sandbox, Oren et al.[33] demonstrated that it is possible to mount cache attacks in JavaScript. Since their work, a series of microarchitectural attacks have been mounted from websites, such as page deduplication attacks [14], Rowhammer attacks [15], ASLR bypasses [13], and DRAM addressing attacks [40].As a response to these attacks, some-but not all-of the APIs have been restricted by reducing the resolution (e.g., High Precision Time API) [2], [6], [9] or completely removing them (e.g., DeviceOrientation Event Specification) [51]. However, these countermeasures are incomplete as they do not cover all s...

show abstract

Section: A Microarchitectural Attacksmentioning

confidence: 99%

Section: B Microarchitectural and Side-channel Attacks In Javascriptmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…However, these countermeasures are incomplete as they do not cover all sensors and are circumventable [13], [40].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Schwarz

Lipp

Gruss

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

MicroStache: A Lightweight Execution Context for In-Process Safe Region Isolation

Mogosanu

Rane

Dautenhahn

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

NetSpectre: Read Arbitrary Memory over Network

Schwarz

Schwarzl

Lipp

et al. 2019

Lecture Notes in Computer Science

125

141

View full text Add to dashboard Cite

Speculative execution is a crucial cornerstone to the performance of modern processors. During speculative execution, the processor may perform operations the program usually would not perform. While the architectural effects and results of such operations are discarded if the speculative execution is aborted, microarchitectural side effects may remain. The recently published Spectre attacks exploit these side effects to read memory contents of other programs. However, Spectre attacks require some form of local code execution on the target system. Hence, systems where an attacker cannot run any code at all were, until now, thought to be safe.In this paper, we present NetSpectre, a generic remote Spectre variant 1 attack. For this purpose, we demonstrate the first accessdriven remote Evict+Reload cache attack over network, leaking 15 bits per hour. Beyond retrofitting existing attacks to a network scenario, we also demonstrate the first Spectre attack which does not use a cache covert channel. Instead, we present a novel highperformance AVX-based covert channel that we use in our cachefree Spectre attack. We show that in particular remote Spectre attacks perform significantly better with the AVX-based covert channel, leaking 60 bits per hour from the target system. We verified that our NetSpectre attacks work in local-area networks as well as between virtual machines in the Google cloud.NetSpectre marks a paradigm shift from local attacks, to remote attacks, exposing a much wider range and larger number of devices to Spectre attacks. Spectre attacks now must also be considered on devices which do not run any potentially attacker-controlled code at all. We show that especially in this remote scenario, attacks based on weaker gadgets which do not leak actual data, are still very powerful to break address-space layout randomization remotely. Several of the Spectre gadgets we discuss are more versatile than anticipated. In particular, value-thresholding is a technique we devise, which leaks a secret value without the typical bit selection mechanisms. We outline challenges for future research on Spectre attacks and Spectre mitigations.Responsible Disclosure. We disclosed our results to Intel

show abstract

ASLR on the Line: Practical Cache Attacks on the MMU

Cited by 169 publications

References 41 publications

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

MicroStache: A Lightweight Execution Context for In-Process Safe Region Isolation

NetSpectre: Read Arbitrary Memory over Network

Contact Info

Product

Resources

About