Unveiling your keystrokes: A Cache-based Side-channel Attack on Graphics Libraries

Abstract

Operating systems use shared memory to improve performance. However, as shown in recent studies, attackers can exploit CPU cache side-channels associated with shared memory to extract sensitive information. The attacks that were previously attempted typically only detect the presence of a certain operation and require significant manual analysis to identify and evaluate their effectiveness. Moreover, very few of them target graphics libraries which are commonly used, but difficult to attack. In this paper, we consider the execution time of shared libraries as the side-channel, and showcase a completely automated technique to discover and select exploitable side-channels on shared graphics libraries. In essence, we first collect the cache lines accessed by a victim process during different key presses offline, and then use machine learning to infer the best cache lines (e.g., easily measurable, robust to noise, high information leakage) for a flush and reload attack. We are able to discover effective strategies to classify what keys have been pressed. Using this approach, we not only preclude the need for manual analyses of code and tracesthe automated system discovered many previously unknown sidechannels of the type we are interested in, but also achieve high precision in terms of inferring the sensitive information entered on desktop and Android platforms. We show that our approach infers the passwords with lowercase letters and numbers 10,000-1,000,000 times faster than random guessing. For a large fraction of PINs consisting of 4 to 6 digits, we are able to infer them within 20 and 80 guesses respectively. Finally, we suggest ways to mitigate these attacks.

Dynamic Process Isolation

“…Cache attacks exploit the access-time differences for cached and uncached data. Since their introduction in 1996 [59], they have been used for powerful attacks on cryptographic primitives [59], [77], [98], [7], [80], [76], user interactions [89], [62], [108], or as building blocks for transientexecution attacks [64], [58], [13].…”

Eavesdropping user credentials via GPU side channels on smartphones

“…Mobile CPU caches have also been exploited for side channel attacks, to infer coarse-grained user activities [15,31]. Some recent work further demonstrated the possibility of inferring users' PIN inputs from knowledge about cache behaviors [53], but only achieved low accuracy (30%). In contrast, our proposed attack achieves much higher accuracy (>80%) without requiring any guess, and hence has higher applicability in practical systems.…”

“…Existing hardware eavesdropping attacks on smartphones mainly focus on CPU and on-board sensors. For example, access time on CPU cache provides information about victim applications when they contend for cache accesses [13,15,53], and IMU sensor readings could be used to infer users' keystrokes [1,2,26,33,35,39]. However, the correlations between these hardware data and user activities are usually weak and ambiguous, and are susceptible to various system factors and random noise in practice [25].…”

NetCAT: Practical Cache Attacks from the Network

“…Prior keystroke recovery attacks have targeted procf [48], audio [70], CPU scheduling [71], Wi-Fi Signals [72], interrupts [73] and graphic renderings [74]. Song et al [47] were the first to use SSH network packets to exploit interleaving times for password recovery, using a Hidden Markov Model (HMM) to model character pairs.…”