ExSpectre: Hiding Malware in Speculative Execution

Wampler, Jack; Martiny, Ian; Wustrow, Eric

doi:10.14722/ndss.2019.23409

Cited by 23 publications

(21 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We obtained invaluable insights from past work about side-channel analysis as an approach to detect malware [9,10,14,17,21,30,52,54,57]. Namely, in an IoT context where devices perform welldefined, repetitive tasks that should exhibit little variation from one run to another, measurements of network communications between apps and nearby devices may serve as a good proxy for computing activity (i.e., behavior).…”

Section: Malware Detectionmentioning

confidence: 99%

Recurring verification of interaction authenticity within bluetooth networks

Peters

Pierson

Sen

et al. 2021

Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

Although user authentication has been well explored, device-todevice authentication -specifically in Bluetooth networks -has not seen the same attention. We propose Verification of Interaction Authenticity (VIA) -a recurring authentication scheme based on evaluating characteristics of the communications (interactions) between devices. We adapt techniques from wireless traffic analysis and intrusion-detection systems to develop behavioral models that capture typical, authentic device interactions (behavior); these models enable recurring verification of device behavior. To evaluate our approach we produced a new dataset consisting of more than 300 Bluetooth network traces collected from 20 Bluetooth-enabled smart-health and smart-home devices. In our evaluation, we found that devices can be correctly verified at a variety of granularities, achieving an F1-score of 0.86 or better in most cases. CCS CONCEPTS• Security and privacy → Mobile and wireless security; Intrusion detection systems; Multi-factor authentication.

show abstract

Section: Malware Detectionmentioning

confidence: 99%

Recurring verification of interaction authenticity within bluetooth networks

Peters

Pierson

Sen

et al. 2021

Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks

View full text Add to dashboard Cite

show abstract

“…Almost all modern CPUs have been affected. ese two vulnerabilities and follow-up studies [17] rely on cache side-channels to help complete the attack. In recent years, Intel deployed SGX technology in their CPUs to help users to build a minimal trusted computing base.…”

Section: Side-channel Attacksmentioning

confidence: 99%

“…Attackers pass the result of the previous malicious behavior through it. ExSpectre [17] is a typical example of using a side channel to deliver the results of malicious code execution. As shown in Figure 3, the attacker first trains the branch predictor through trigger codes.…”

Section: Reats Of the Attacksmentioning

confidence: 99%

“…Cache side-channel attacks targeting LLC can leak sensitive information to attackers who share the same package, while these attacks based on L1-D and L1-I cache can only leak to attackers who share the same core. is also explains why more side-channel attacks prefer to use L3 cache in their attacks [4,8,9,12,13,17,20,22,[30][31][32][33][34][35][36][38][39][40][41].…”

Section: Program Vulnerabilitymentioning

confidence: 99%

See 1 more Smart Citation

Survey of CPU Cache-Based Side-Channel Attacks: Systematic Analysis, Security Models, and Countermeasures

Zeng

2021

Security and Communication Networks

View full text Add to dashboard Cite

Privacy protection is an essential part of information security. The use of shared resources demands more privacy and security protection, especially in cloud computing environments. Side-channel attacks based on CPU cache utilize shared CPU caches within the same physical device to compromise the system’s privacy (encryption keys, program status, etc.). Information is leaked through channels that are not intended to transmit information, jeopardizing system security. These attacks have the characteristics of both high concealment and high risk. Despite the improvement in architecture, which makes it more difficult to launch system intrusion and privacy leakage through traditional methods, side-channel attacks ignore those defenses because of the shared hardware. Difficult to be detected, they are much more dangerous in modern computer systems. Although some researchers focus on the survey of side-channel attacks, their study is limited to cryptographic modules such as Elliptic Curve Cryptosystems. All the discussions are based on real-world applications (e.g., Curve25519), and there is no systematic analysis for the related attack and security model. Firstly, this paper compares different types of cache-based side-channel attacks. Based on the comparison, a security model is proposed. The model describes the attacks from four key aspects, namely, vulnerability, cache type, pattern, and range. Through reviewing the corresponding defense methods, it reveals from which perspective defense strategies are effective for side-channel attacks. Finally, the challenges and research trends of CPU cache-based side-channel attacks in both attacking and defending are explored. The systematic analysis of CPU cache-based side-channel attacks highlights the fact that these attacks are more dangerous than expected. We believe our survey would draw developers’ attention to side-channel attacks and help to reduce the attack surface in the future.

show abstract

“…They demonstrated their approach by leaking keystrokes and by executing arbitrary code speculatively. These bugs have been shown to be remotely exploitable [86] and researchers have tried to hide malware in the "speculative world" [87,88]. The list of works exploiting speculative execution is still growing [89,90,91,92,93].…”

Section: Transient Execution Attacksmentioning

confidence: 99%

Analysis and design of microarchitectural side-channel attacks and countermeasures

Herrero¹

View full text Add to dashboard Cite

Nowadays, computer systems are highly optimized to achieve the maximum performance for the existing fabrication technologies. Each processor includes multiple cores and even multiple threads per core, components that allow it to predict the execution path before it is actually taken, shared resources that are efficiently managed, etc. Indeed, these optimized systems have brought a number of technologies that facilitate our daily tasks such as cloud computing. However, computer designers have not considered that these microarchitectural improvements can open a back door for malicious agents. Actually, these components that enhance performance introduce, at the same time, measurable side-effects on the system that can be exploited by an adversary to retrieve secret from the processes running in the system. As it has been demonstrated, the hardware can undermine the security of a system. The attacks that exploit the aforementioned side-effects are known as side-channel attacks; in particular, as microarchitectural side-channel attacks.

show abstract

ExSpectre: Hiding Malware in Speculative Execution

Cited by 23 publications

References 29 publications

Recurring verification of interaction authenticity within bluetooth networks

Recurring verification of interaction authenticity within bluetooth networks

Survey of CPU Cache-Based Side-Channel Attacks: Systematic Analysis, Security Models, and Countermeasures

Analysis and design of microarchitectural side-channel attacks and countermeasures

Contact Info

Product

Resources

About