Data remanence and digital forensic investigation for CUDA Graphics Processing Units

Abstract

This paper investigates the practicality of memory attacks on commercial Graphics Processing Units (GPUs). With recent advances in the performance and viability of using GPUs for various highly-parallelised data processing tasks, a number of security challenges are raised. Unscrupulous software running subsequently on the same GPU, either by the same user, or another user, in a multiuser system, may be able to gain access to the contents of the GPU memory. This contains data from previous program executions. In certain use-cases, where the GPU is used to offload intensive parallel processing such as pattern matching for an intrusion detection system, financial systems, or cryptographic algorithms, it may be possible for the GPU memory to contain privileged data, which would ordinarily be inaccessible to an unprivileged application running on the host computer. With GPUs potentially yielding access to confidential information, existing research in the field is built upon, to investigate the practicality of extracting data from global, shared and texture memory, and retrieving this data for further analysis. These techniques are also implemented on various GPUs using three different Nvidia CUDA versions. A novel methodology for digital forensic examination of GPU memory for remanent data is then proposed, along with some suggestions and considerations towards countermeasures and anti-forensic techniques.

More than a Fair Share: Network Data Remanence Attacks against Secret Sharing-based Schemes

“…Data Remanence Attacks: Data remanence in the context of storage devices has been studied extensively in the literature. We refer the reader to the vast body of literature on that topic [19], [20], [4], [5]. Networks are also vulnerable to memory data remanence attacks as memory is a main component of switches.…”

A Survey of Techniques for Improving Security of GPUs

“…Bellekens et al [36] discuss ways in which remanent sensitive data may be leaked from the global, shared and texture memory of a GPU. For GlM, a benign user transfers data from the host to the GPU using cudaMalloc and cudaMemcpy.…”

Strategies for Protecting Intellectual Property when Using CUDA Applications on Graphics Processing Units

“…Having the ability to investigate the operation of CUDAbased software is of great importance, specifically given the well-documented use of GPUs for the unauthorised processing of potentially confidential data [1], as well as for use in compression and cryptography [15]. With sensitive data routinely being exposed to GPUs, the ability for forensic investigators to respond to security incidents involving the potential compromise of these systems and rapidly investigate the precise nature of the suspect code involved, is critical to presenting an effective incident response.…”

“…Being able to identify the operations carried out may allow an investigator to establish the potential exposure of confidential information, or to identify what operations were carried out on data previously held on the GPU [1]. Analysis may be necessary for the purpose of creating intrusion detection system signatures [2] or the detection and classification of similar threats in future.…”

“…In the case of forensic investigation, the ability to analyse GPU-based memory may yield important clues as to the data which was processed by the GPU and therefore what data may have been accessed by an attacker, as a result of data remanence on GPUs [1]. This analysis, however, requires a forensic investigator to know specific details of memory allocation of the CUDA binary, which would need to be obtained through reverse engineering of the target CUDA software.…”