Indexado en

Licencia y uso

Citaciones

2

CITATIONS

2 Total citations

2 Recent citations

0.63 Field Citation Ratio

n/a Relative Citation Ratio

Cited 6 times in

Cited 2 times in

Cited 7 times in

Cited 2 times in

Altmetrics

Grant support

This research was supported by DFG (Projects 427774779 and 439797619) and by the Spanish MINECO under grant PID2019110866RB-I00.

Análisis de autorías institucional

Compartir

Aim, Wait, Shoot: How the CACHESNIPER Technique Improves Unprivileged Cache Attacks

Publicado en:2021 Ieee European Symposium On Security And Privacy (Euros&p 2021). 683-700 - 2021-01-01 (), DOI: 10.1109/EuroSP51992.2021.00051

Autores: Briongos, Samira; Bruhns, Ida; Malagon, Pedro; Eisenbarth, Thomas; Moya, Jose M

Afiliaciones

Resumen

Microarchitectural side channel attacks have been very prominent in security research over the last few years. Caches proved to be an outstanding side channel, as they provide high resolution and generic cross-core leakage. All major cryptographic libraries provide countermeasures to hinder key extraction via cross-core cache attacks by now. In this paper, we analyze implementations protected by prefetch-based countermeasures aimed at preventing well-known cache attacks, and highlight the circumstances causing them to remain vulnerable. Further, we craft a novel attack technique that precisely synchronizes the attacking and the victim processes, enabling the attacking process to evict the target data from the cache at the desired instants. One key improvement of our approach is that it provides unprivileged attackers with a method to remove specific data from the cache with a single memory access and in absence of shared memory by leveraging the transient capabilities of TSX and relying on the L3 replacement policy. We show the feasibility of our approach by extracting an RSA key from the latest wolfSSL library and an AES key from the T-Table and S-Box implementations included in OpenSSL with CACHESNIPER. Both libraries implement prefetch-based methods as a protection against cache attacks.

Palabras clave