Profit: Detecting and Quantifying Side Channels in Networked Applications

Abstract

We present a black-box, dynamic technique to detect and quantify side-channel information leaks in networked applications that communicate through a TLS-encrypted stream. Given a user-supplied profiling-input suite in which some aspect of the inputs is marked as secret, we run the application over the inputs and capture a collection of variable-length network packet traces. The captured traces give rise to a vast side-channel feature space, including the size and timestamp of each individual packet as well as their aggregations (such as total time, median size, etc.) over every possible subset of packets. Finding the features that leak the most information is a difficult problem. Our approach addresses this problem in three steps: 1) Global analysis of traces for their alignment and identification of phases across traces; 2) Feature extraction using the identified phases; 3) Information leakage quantification and ranking of features via estimation of probability distribution. We embody this approach in a tool called Profit and experimentally evaluate it on a benchmark of applications from the DARPA STAC program, which were developed to assess the effectiveness of side-channel analysis techniques. Our experimental results demonstrate that, given suitable profiling-input suites, Profit is successful in automatically detecting information-leaking features in applications, and correctly ordering the strength of the leakage for differently-leaking variants of the same application.

Feedback-driven side-channel analysis for networked applications

“…Each output feature can be affected by any part of the input-including those that are related to the secret of interest, and those that are not. Prior work [14,15,40,47] requires the user to provide the full input suite before the analysis begins. Thus, the user must sample the input space in some way that covers all its dimensions adequately.…”

“…Assume that a software system, use case, and secret of interest are selected by the user. We reuse the following definitions from the system model in [40]. The input domain I is the set of all valid inputs for the use case.…”

“…There has been prior work on quantifying leakage in network traces in particular [40,47] and in program traces in general [14,15]. However, all of them rely on manually generated input suites and do not address the problem of the quality of the input suite.…”

Detection and mitigation of JIT-induced side channels

“…Potential side channels include those in execution time, memory usage, size and timings of network packets, and power consumption. Although side-channel vulnerabilities due to hardware (such as vulnerabilities that exploit the cache behavior) have been extensively studied [1, 2, 10, 13, 15-17, 19, 23], software side channels have only recently become an active area of research, including recent results on software side-channel detection [4,8,11,12,18,22,24] and quantification [5,20,21], and Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored.…”

Efficient Detection and Quantification of Timing Leaks with Neural Networks

“…The works [23,50] Dynamic Analysis for Side-Channel Detections. Dynamic analysis has been used for side-channel detections [38,41,42]. Diffuzz [41] is a fuzzing techniques for finding side channels.…”