Opening Pandora’s Box: A Systematic Study of New Ways Microarchitecture Can Leak Private Data

Vicarte, Jose Rodrigo Sanchez; Shome, Pradyumna; Nayak, Nandeeka; Trippel, Caroline; Morrison, Adam; Kohlbrenner, David; Fletcher, Christopher W.

doi:10.1109/isca52012.2021.00035

Cited by 17 publications

(4 citation statements)

References 75 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Prefetchers have been exploited to leak data from program memory either through side channels [7,17,29,30,32] or by constructing covert channels [7,8,28]. Side-channel attacks exploiting prefetching target either hardware-based or software-based prefetching.…”

Section: Prefetcher Exploitationmentioning

confidence: 99%

See 1 more Smart Citation

FetchBench: Systematic Identification and Characterization of Proprietary Prefetchers

Schlüter,

Choudhari,

Hetterich

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Prefetchers speculatively fetch memory using predictions on future memory use by applications. Different CPUs may use different prefetcher types, and two implementations of the same prefetcher can differ in details of their characteristics, leading to distinct runtime behavior. For a few implementations, security researchers showed through manual analysis how to exploit specific prefetchers to leak data. Identifying such vulnerabilities required tedious reverse-engineering, as prefetcher implementations are proprietary and undocumented. So far, no systematic study of prefetchers in common CPUs is available, preventing further security assessment.In this work, we address the following question: How can we systematically identify and characterize under-specified prefetchers in proprietary processors? To answer this question, we systematically analyze approaches to prefetching, design cross-platform tests to identify and characterize prefetchers on a given CPU, and demonstrate that our implementation FetchBench can characterize prefetchers on 19 different ARM and x86-64 CPUs. For example, FetchBench uncovers and characterizes a previously unknown replay-based prefetcher on the ARM Cortex-A72 CPU. Based on these findings, we demonstrate two novel attacks that exploit this undocumented prefetcher as a side channel to leak secret information, even from the secure TrustZone into the normal world. CCS CONCEPTS• Security and privacy → Side-channel analysis and countermeasures.

show abstract

Section: Prefetcher Exploitationmentioning

confidence: 99%

“…Recent works [29,30] examine data memory-dependent prefetchers [42], such as the pointer-array prefetcher in Apple M1 processors [29]. This prefetcher is exploited to perform out-of-bounds reads and retrieve leaked pointers.…”

Section: Prefetcher Exploitationmentioning

confidence: 99%

FetchBench: Systematic Identification and Characterization of Proprietary Prefetchers

Schlüter,

Choudhari,

Hetterich

et al. 2023

Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Moreover, the main source of concern for energy usage in IoT systems is data transmission bandwidth and speed of response, which are regarded as cloud computing operating costs [6]. All digital apps have progressed with microprocessors, each with a dedicated processing unit for an intended area [7]. However, causing damage to the microarchitecture element influenced the whole system by ingesting a large amount of power and assets [8].…”

Section: Introductionmentioning

confidence: 99%

An Intelligent Fault Alert Mechanism for Dynamic IoT Communication Microarchitecture

Gaikwad,

2023

IJRITCC

View full text Add to dashboard Cite

The usage Internet of Things (IoT) was maximized throughout the entire world. Hence, the different core processors incorporated microarchitecture makes this IoT communication system. However, the rise of faults due to the malicious event and the data overload might maximize energy and power utilization. So, the current study has proposed a novel Chimp-based Domain adaptation Alert System (CbDAAS) for the dynamic IoT communication microarchitecture. Before initiating the communication sharing process, the present fault in the designed IoT dynamic core microarchitecture was predicted, and those cores were removed for the current data broadcasting process. Henceforth, the designed fault alert microarchitecture is tested in the MATLAB platform. The reliability was valued using different metrics like power usage, energy consumption and detection exactness value. Finally, the validated metrics were compared with the associated studies and scored the finest outcome in fault detection score as 98% and less energy usage at 0.025mj.

show abstract

“…To make things worse, a recent survey [18] highlighted seven classes of microarchitectural optimizations that all undermine the constant-time paradigm. While exploiting some of these optimizations in commodity processors may seem unrealistic, an attack called Augury [19] demonstrated that this threat is not only a theoretical one.…”

Section: Introductionmentioning

confidence: 99%

Towards a formally verified hardware root-of-trust for data-oblivious computing

Deutschmann

Müller

Fadiheh

et al. 2022

Proceedings of the 59th ACM/IEEE Design Automation Conference

View full text Add to dashboard Cite

The importance of preventing microarchitectural timing side channels in security-critical applications has surged in recent years. Constant-time programming has emerged as a best-practice technique for preventing the leakage of secret information through timing. It is based on the assumption that the timing of certain basic machine instructions is independent of their respective input data. However, whether or not an instruction satisfies this data-independent timing criterion varies between individual processor microarchitectures.In this paper, we propose a novel methodology to formally verify data-oblivious behavior in hardware using standard property checking techniques. The proposed methodology is based on an inductive property that enables scalability even to complex outof-order cores. We show that proving this inductive property is sufficient to exhaustively verify data-obliviousness at the microarchitectural level. In addition, the paper discusses several techniques that can be used to make the verification process easier and faster.We demonstrate the feasibility of the proposed methodology through case studies on several open-source designs. One case study uncovered a data-dependent timing violation in the extensively verified and highly secure IBEX RISC-V core. In addition to several hardware accelerators and in-order processors, our experiments also include RISC-V BOOM, a complex out-of-order processor, highlighting the scalability of the approach.

show abstract

Opening Pandora’s Box: A Systematic Study of New Ways Microarchitecture Can Leak Private Data

Cited by 17 publications

References 75 publications

FetchBench: Systematic Identification and Characterization of Proprietary Prefetchers

FetchBench: Systematic Identification and Characterization of Proprietary Prefetchers

An Intelligent Fault Alert Mechanism for Dynamic IoT Communication Microarchitecture

Towards a formally verified hardware root-of-trust for data-oblivious computing

Contact Info

Product

Resources

About