Deterministic Browser

Abstract

Timing attacks have been a continuous threat to users' privacy in modern browsers. To mitigate such attacks, existing approaches, such as Tor Browser and Fermata, add jitters to the browser clock so that an attacker cannot accurately measure an event. However, such defenses only raise the bar for an attacker but do not fundamentally mitigate timing attacks, i.e., it just takes longer than previous to launch a timing attack.In this paper, we propose a novel approach, called deterministic browser, which can provably prevent timing attacks in modern browsers. Borrowing from Physics, we introduce several concepts, such as an observer and a reference frame. Specifically, a snippet of JavaScript, i.e., an observer in JavaScript reference frame, will always obtain the same, fixed timing information so that timing attacks are prevented; at contrast, a user, i.e., an oracle observer, will perceive the JavaScript differently and do not experience the performance slowdown. We have implemented a prototype called D F and our evaluation shows that the prototype can defend against browser-related timing attacks. CCS CONCEPTS• Security and privacy → Browser security; Web application security;

Grand Pwning Unit: Accelerating Microarchitectural Attacks with the GPU

“…Precise timers serve as a key building block for a variety of side-channel attacks and for this reason a number of stateof-the-art defenses specifically aim to remove the attackers' ability to construct them [9], [29], [44]. We will show that our GPU-based timers bypass such novel defenses.…”

“…To compromise the target system, we assume the attacker can only rely on microarchitectural attacks by harnessing the primitives provided by the GPU. We also assume a target system with all defenses up, including advanced research defenses (applicable to the ARM platform), which hamper reliable timing sources in the browser [9], [29] and protect kernel memory from Rowhammer attacks [8].…”

“…Recent work shows that these attacks are even possible through malicious JavaScript applications [7], [18], [20], [38], significantly increasing their real-world impact. To counter this threat, the research community has proposed a number of sophisticated defense mechanisms [8], [9], [29]. However, these defenses implicitly assume that the attacker's capabilities are limited to those of the main CPU cores.…”

“…Worse, attackers can unlock the latent power of GPUs even from JavaScript code running inside the browser, paving the way for a new and more powerful family of remote microarchitectural attacks. We demonstrate the potential of such attacks by bypassing state-of-the-art browser defenses [9], [29], [44] and presenting the first reliable GPU-based Rowhammer attack that compromises a browser on a phone in under two minutes.…”

ret2spec

“…At this point, the return instruction in step (5) returns from B to A and triggers the first misprediction. In step (6), N A more returns will be executed, all of them mispredicting B as the return target. The state of the RSB (shortened to N = 4) after each of these steps is also depicted in Figure 2.…”