Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3445814.3446729acmconferencesArticle/Chapter ViewAbstractPublication PagesasplosConference Proceedingsconference-collections
research-article
Public Access

Computing with time: microarchitectural weird machines

Published: 17 April 2021 Publication History

Abstract

Side-channel attacks such as Spectre rely on properties of modern CPUs that permit discovery of microarchitectural state via timing of various operations. The Weird Machine concept is an increasingly popular model for characterization of emergent execution that arises from side-effects of conventional computing constructs. In this work we introduce Microarchitectural Weird Machines (µWM): code constructions that allow performing computation through the means of side effects and conflicts between microarchitectual entities such as branch predictors and caches. The results of such computations are observed as timing variations. We demonstrate how µWMs can be used as a powerful obfuscation engine where computation operates based on events unobservable to conventional anti-obfuscation tools based on emulation, debugging, static and dynamic analysis techniques. We demonstrate that µWMs can be used to reliably perform arbitrary computation by implementing a SHA-1 hash function. We then present a practical example in which we use a µWM to obfuscate malware code such that its passive operation is invisible to an observer with full power to view the architectural state of the system until the code receives a trigger. When the trigger is received the malware decrypts and executes its payload. To show the effectiveness of obfuscation we demonstrate its use in the concealment and subsequent execution of a payload that exfiltrates a shadow password file, and a payload that creates a reverse shell.

References

[1]
Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2009. Control-flow integrity principles, implementations, and applications. ACM Transactions on Information and System Security (TISSEC) 13, 1 ( 2009 ), 4.
[2]
Andrew W Appel. 2001. Foundational proof-carrying code. In Proceedings 16th Annual IEEE Symposium on Logic in Computer Science. IEEE, 247-256.
[3]
Roberto Baldoni, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu, and Irene Finocchi. 2018. A survey of symbolic execution techniques. ACM Computing Surveys (CSUR) 51, 3 ( 2018 ), 1-39.
[4]
Julian Bangert, Sergey Bratus, Rebecca Shapiro, and Sean W Smith. 2013. The Page-Fault Weird Machine: Lessons in Instruction-less Computation. In Presented as part of the 7th USENIX Workshop on Ofensive Technologies. https://www.cs. dartmouth.edu/~sergey/wm/woot13-bangert.pdf.
[5]
Thomas Benjamin, Jef Eitel, Jesse Elwell, Dmitry Evtyushkin, and Ghosh Abhrajit. 2020. Weird Circuits in CPU Microarchitectures. Presentation, The Sixth Workshop on Language-Theoretic Security (LangSec) ( 2020 ). http://spw20.langsec.org/slides/ WeirdCircuits_LangSec2020.pdf, Accessed: 2020-12-18.
[6]
Sandeep Bhatkar, Daniel C DuVarney, and Ron Sekar. 2003. Address Obfuscation: An Eficient Approach to Combat a Broad Range of Memory Error Exploits. In USENIX Security Symposium, Vol. 12. 291-301.
[7]
Jan Olaf Blech and Sidi Ould Biha. 2011. Verification of PLC properties based on formal semantics in Coq. In International Conference on Software Engineering and Formal Methods. Springer, 58-73.
[8]
Sylvie Boldo and Jean-Christophe Filliâtre. 2007. Formal verification of floatingpoint programs. In 18th IEEE Symposium on Computer Arithmetic (ARITH'07). IEEE, 187-194.
[9]
Sergey Bratus. What are Weird Machines? https://www.cs.dartmouth.edu/ ~sergey/wm/. Accessed: 2020-12-18.
[10]
Alexei Bulazel and Bülent Yener. 2017. A survey on automated dynamic malware analysis evasion and counter-evasion: Pc, mobile, and web. In Proceedings of the 1st Reversing and Ofensive-oriented Trends Symposium. 1-21.
[11]
Jerry R Burch, Edmund M Clarke, Kenneth L McMillan, David L Dill, and LainJinn Hwang. 1992. Symbolic model checking: 1020 states and beyond. Information and computation 98, 2 ( 1992 ), 142-170.
[12]
Iker Burguera, Urko Zurutuza, and Simin Nadjm-Tehrani. 2011. Crowdroid: behavior-based malware detection system for android. In Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices. ACM, 15-26.
[13]
Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin Von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, and Daniel Gruss. 2019. A systematic evaluation of transient execution attacks and defenses. In 28th USENIX Security Symposium (USENIX) Security 19 ). 249-266.
[14]
Mihai Christodorescu, Somesh Jha, Sanjit A Seshia, Dawn Song, and Randal E Bryant. 2005. Semantics-aware malware detection. In 2005 IEEE Symposium on Security and Privacy (S&P'05). IEEE, 32-46.
[15]
James Clause, Wanchun Li, and Alessandro Orso. 2007. Dytan: a generic dynamic taint analysis framework. In Proceedings of the 2007 international symposium on Software testing and analysis. 196-206.
[16]
Robert Collins. Intel's System Management Mode. ([n. d.]). http://www.rcollins. org/ddj/Jan97/Jan97.html, Accessed: 2021-01-26.
[17]
Asish Kumar Dalai, Shakya Sundar Das, and Sanjay Kumar Jena. 2017. A code obfuscation technique to prevent reverse engineering. In 2017 International Conference on Wireless Communications, Signal Processing and Networking (WiSPNET). IEEE, 828-832.
[18]
Gregory William Dalcher and John D Teddy. 2013. Systems and methods for behavioral sandboxing. US Patent 8, 479, 286.
[19]
Christopher Domas. 2017. Breaking the x86 ISA. Black Hat ( 2017 ).
[20]
Thomas F Dullien. 2017. Weird machines, exploitability, and provable unexploitability. IEEE Transactions on Emerging Topics in Computing ( 2017 ).
[21]
William Enck, Peter Gilbert, Seungyeop Han, Vasant Tendulkar, Byung-Gon Chun, Landon P Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N Sheth. 2014. TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Transactions on Computer Systems (TOCS) 32, 2 ( 2014 ), 1-29.
[22]
Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh. 2016. Jump over ASLR: Attacking branch predictors to bypass ASLR. In 2016 49th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO). IEEE, 1-13.
[23]
Dmitry Evtyushkin, Ryan Riley, Nael CSE Abu-Ghazaleh, ECE, and Dmitry Ponomarev. 2018. Branchscope: A new side-channel attack on directional branch predictor. ACM SIGPLAN Notices 53, 2 ( 2018 ), 693-707.
[24]
Seyed K Fayaz, Tianlong Yu, Yoshiaki Tobioka, Sagar Chaki, and Vyas Sekar. 2016. BUZZ: Testing Context-Dependent Policies in Stateful Networks. In 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16). 275-289.
[25]
Xinyu Feng, Zhaozhong Ni, Zhong Shao, and Yu Guo. 2007. An open framework for foundational proof-carrying code. In Proceedings of the 2007 ACM SIGPLAN international workshop on Types in languages design and implementation. ACM, 67-78.
[26]
Bryan Ford and Russ Cox. 2008. Vx32: Lightweight User-level Sandboxing on the x86. In USENIX Annual Technical Conference. Boston, MA, 293-306.
[27]
Yanick Fratantonio, Antonio Bianchi, William Robertson, Engin Kirda, Christopher Kruegel, and Giovanni Vigna. 2016. Triggerscope: Towards detecting logic bombs in android applications. In 2016 IEEE symposium on security and privacy (SP). IEEE, 377-396.
[28]
Marco Guarnieri, Boris Köpf, José F Morales, Jan Reineke, and Andrés Sánchez. 2020. SPECTECTOR: Principled detection of speculative information flows. In 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 1-19.
[29]
Xiaolong Guo, Raj Gautam Dutta, Yier Jin, Farimah Farahmandi, and Prabhat Mishra. 2015. Pre-silicon security verification and validation: A formal perspective. In Proceedings of the 52nd Annual Design Automation Conference. ACM, 145.
[30]
Klaus Havelund, Doron Peled, and Dogan Ulus. 2017. First order temporal logic monitoring with BDDs. In Proceedings of the 17th Conference on Formal Methods in Computer-Aided Design. FMCAD Inc, 116-123.
[31]
Xuxian Jiang, Xinyuan Wang, and Dongyan Xu. 2007. Stealthy malware detection through vmm-based out-of-the-box semantic view reconstruction. In Proceedings of the 14th ACM conference on Computer and communications security. ACM, 128-138.
[32]
Min Gyung Kang, Heng Yin, Steve Hanna, Stephen McCamant, and Dawn Song. 2009. Emulating emulation-resistant malware. In Proceedings of the 1st ACM workshop on Virtual machine security. 11-22.
[33]
Khaled N Khasawneh, Esmaeil Mohammadian Koruyeh, Chengyu Song, Dmitry Evtyushkin, Dmitry Ponomarev, and Nael Abu-Ghazaleh. 2019. Safespec: Banishing the spectre of a meltdown with leakage-free speculation. In 2019 56th ACM/IEEE Design Automation Conference (DAC). IEEE, 1-6.
[34]
Paul Kocher, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. 2018. Spectre attacks: Exploiting speculative execution. arXiv preprint arXiv: 1801. 01203 ( 2018 ). https://spectreattack.com/spectre.pdf.
[35]
Xavier Leroy. 2009. Formal verification of a realistic compiler. Commun. ACM 52, 7 ( 2009 ), 107-115.
[36]
Xavier Leroy et al. 2012. The CompCert verified compiler. Documentation and user's manual. INRIA Paris-Rocquencourt 53 ( 2012 ).
[37]
Cullen Linn and Saumya Debray. 2003. Obfuscation of executable code to improve resistance to static disassembly. In Proceedings of the 10th ACM conference on Computer and communications security. 290-299.
[38]
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. 2018. Meltdown. arXiv preprint arXiv: 1801. 01207 ( 2018 ). https://arxiv.org/pdf/ 1801.01207.
[39]
Andrea Mambretti, Matthias Neugschwandtner, Alessandro Sorniotti, Engin Kirda, William Robertson, and Anil Kurmus. 2019. Speculator: a tool to analyze speculative execution attacks and mitigations. In Proceedings of the 35th Annual Computer Security Applications Conference. 747-761.
[40]
Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L Titzer, and Toon Verwaest. 2019. Spectre is here to stay: An analysis of side-channels and speculative execution. arXiv preprint arXiv: 1902. 05178 ( 2019 ).
[41]
Neophytos G Michael and Andrew W Appel. 2000. Machine instruction syntax and semantics in higher order logic. In International Conference on Automated Deduction. Springer, 7-24.
[42]
Marina Minkin, Daniel Moghimi, Moritz Lipp, Michael Schwarz, Jo Van Bulck, Daniel Genkin, Daniel Gruss, Frank Piessens, Berk Sunar, and Yuval Yarom. 2019. Fallout: Reading kernel writes from user space. arXiv preprint arXiv:1905. 12701 ( 2019 ).
[43]
Samira Mirbagher-Ajorpaz, Gilles Pokam, Esmaeil Mohammadian-Koruyeh, Elba Garza, Nael Abu-Ghazaleh, and Daniel A Jiménez. 2020. PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron. In 2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO). IEEE, 1124-1137.
[44]
George C Necula. 1997. Proof-carrying code. In Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages. ACM, 106-119.
[45]
James Newsome and Dawn Xiaodong Song. 2005. Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software. In NDSS, Vol. 5. Citeseer, 3-4.
[46]
James Oakley and Sergey Bratus. 2011. Exploiting the Hard-Working DWARF: Trojan and Exploit Techniques with No Native Executable Code. In WOOT. 91-102.
[47]
Vasilis Pappas, Michalis Polychronakis, and Angelos D Keromytis. 2012. Smashing the gadgets: Hindering return-oriented programming using in-place code randomization. In 2012 IEEE Symposium on Security and Privacy. IEEE, 601-615.
[48]
Christos Sakalis, Stefanos Kaxiras, Alberto Ros, Alexandra Jimborean, and Magnus Själander. 2019. Eficient invisible speculative execution through selective delay and value prediction. In 2019 ACM/IEEE 46th Annual International Symposium on Computer Architecture (ISCA). IEEE, 723-735.
[49]
A-D Schmidt, Rainer Bye, H-G Schmidt, Jan Clausen, Osman Kiraz, Kamer A Yuksel, Seyit Ahmet Camtepe, and Sahin Albayrak. 2009. Static analysis of executables for collaborative malware detection on android. In 2009 IEEE International Conference on Communications. IEEE, 1-5.
[50]
Sebastian Schrittwieser, Stefan Katzenbeisser, Johannes Kinder, Georg Merzdovnik, and Edgar Weippl. 2016. Protecting software through obfuscation: Can it keep pace with progress in code analysis? ACM Computing Surveys (CSUR) 49, 1 ( 2016 ), 1-37.
[51]
Michael Schwarz, Moritz Lipp, Daniel Moghimi, Jo Van Bulck, Julian Stecklina, Thomas Prescher, and Daniel Gruss. 2019. ZombieLoad: Cross-privilege-boundary data sampling. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 753-768.
[52]
Michael Schwarz, Martin Schwarzl, Moritz Lipp, Jon Masters, and Daniel Gruss. 2019. Netspectre: Read arbitrary memory over network. In European Symposium on Research in Computer Security. Springer, 279-299.
[53]
Asaf Shabtai, Uri Kanonov, Yuval Elovici, Chanan Glezer, and Yael Weiss. 2012. ? Andromaly?: a behavioral malware detection framework for android devices. Journal of Intelligent Information Systems 38, 1 ( 2012 ), 161-190.
[54]
Hovav Shacham. 2007. The geometry of innocent flesh on the bone: Return-intolibc without function calls (on the x86). In Proceedings of the 14th ACM conference on Computer and communications security. 552-561.
[55]
Rebecca Shapiro, Sergey Bratus, and Sean W Smith. 2013. ? Weird Machines? in ELF: A Spotlight on the Underappreciated Metadata. In Presented as part of the 7th USENIX Workshop on Ofensive Technologies. https://www.cs.dartmouth.edu/ ~sergey/wm/woot13-shapiro.pdf.
[56]
Monirul I Sharif, Andrea Lanzi, Jonathon T Gifin, and Wenke Lee. 2008. Impeding Malware Analysis Using Conditional Code Obfuscation. In NDSS.
[57]
Baljit Singh, Dmitry Evtyushkin, Jesse Elwell, Ryan Riley, and Iliano Cervesato. 2017. On the detection of kernel-level rootkits using hardware performance counters. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security. 483-493.
[58]
Jakub Szefer. 2018. Survey of Microarchitectural Side and Covert Channels, Attacks, and Defenses. Journal of Hardware and Systems Security ( 2018 ), 1-16. https: //pdfs.semanticscholar.org/4b99/854f2aac10f41902b738c4b783d7c187a61a.pdf.
[59]
Jakub Szefer. 2019. Survey of microarchitectural side and covert channels, attacks, and defenses. Journal of Hardware and Systems Security 3, 3 ( 2019 ), 219-234.
[60]
Stephan Van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, and Cristiano Giufrida. 2019. RIDL: Rogue in-flight data load. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 88-105.
[61]
Jack Wampler, Ian Martiny, and Eric Wustrow. 2019. ExSpectre: Hiding Malware in Speculative Execution. In NDSS.
[62]
Guanhua Wang, Sudipta Chattopadhyay, Ivan Gotovchits, Tulika Mitra, and Abhik Roychoudhury. 2018. oo7: Low-overhead defense against spectre attacks via binary analysis. arXiv preprint arXiv:1807. 05843 ( 2018 ).
[63]
Zhenghong Wang and Ruby B Lee. 2006. Covert and side channels due to processor architecture. In 2006 22nd Annual Computer Security Applications Conference (ACSAC'06). IEEE, 473-482.
[64]
Yuan Xiao, Yinqian Zhang, and Radu Teodorescu. 2019. SPEECHMINER: A Framework for Investigating and Measuring Speculative Execution Vulnerabilities. arXiv preprint arXiv: 1912. 00329 ( 2019 ).
[65]
Wenjie Xiong and Jakub Szefer. 2020. Leaking information through cache LRU states. In 2020 IEEE International Symposium on High Performance Computer Architecture (HPCA). IEEE, 139-152.
[66]
Bennet Yee, David Sehr, Gregory Dardyk, J Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar. 2009. Native client: A sandbox for portable, untrusted x86 native code. In 2009 30th IEEE Symposium on Security and Privacy. IEEE, 79-93.
[67]
Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda. 2007. Panorama: capturing system-wide information flow for malware detection and analysis. In Proceedings of the 14th ACM conference on Computer and communications security. ACM, 116-127.
[68]
Mingwei Zhang and R Sekar. 2013. Control Flow Integrity for {COTS} Binaries. In Presented as part of the 22nd {USENIX} Security Symposium ({ USENIX} Security 13). 337-352.
[69]
Tianwei Zhang, Yinqian Zhang, and Ruby B Lee. 2016. Cloudradar: A real-time side-channel attack detection system in clouds. In International Symposium on Research in Attacks, Intrusions, and Defenses. Springer, 118-140.

Cited By

View all
  • (2024)Weird Machines in Package Managers: A Case Study of Input Language Complexity and Emergent Execution in Software Systems2024 IEEE Security and Privacy Workshops (SPW)10.1109/SPW63631.2024.00021(169-179)Online publication date: 23-May-2024
  • (2023)The gates of timeProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620347(1955-1972)Online publication date: 9-Aug-2023
  • (2023)The ghost is the machine: Weird machines in transient execution2023 IEEE Security and Privacy Workshops (SPW)10.1109/SPW59333.2023.00029(264-272)Online publication date: May-2023
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
ASPLOS '21: Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems
April 2021
1090 pages
ISBN:9781450383172
DOI:10.1145/3445814
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 17 April 2021

Permissions

Request permissions for this article.

Check for updates

Badges

  • Best Paper

Author Tags

  1. Microarchitecture security
  2. obfuscation
  3. side channel
  4. speculative execution
  5. weird machines

Qualifiers

  • Research-article

Funding Sources

  • DARPA

Conference

ASPLOS '21
Sponsor:

Acceptance Rates

Overall Acceptance Rate 535 of 2,713 submissions, 20%

Upcoming Conference

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)268
  • Downloads (Last 6 weeks)39
Reflects downloads up to 17 Oct 2024

Other Metrics

Citations

Cited By

View all
  • (2024)Weird Machines in Package Managers: A Case Study of Input Language Complexity and Emergent Execution in Software Systems2024 IEEE Security and Privacy Workshops (SPW)10.1109/SPW63631.2024.00021(169-179)Online publication date: 23-May-2024
  • (2023)The gates of timeProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620347(1955-1972)Online publication date: 9-Aug-2023
  • (2023)The ghost is the machine: Weird machines in transient execution2023 IEEE Security and Privacy Workshops (SPW)10.1109/SPW59333.2023.00029(264-272)Online publication date: May-2023
  • (2022)STBPU: A Reasonably Secure Branch Prediction Unit2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)10.1109/DSN53405.2022.00023(109-123)Online publication date: Jun-2022
  • (2021)Static Analysis of PE files Using Neural Network Techniques for a Pocket Tool2021 International Conference on Electrical, Computer, Communications and Mechatronics Engineering (ICECCME)10.1109/ICECCME52200.2021.9590958(01-06)Online publication date: 7-Oct-2021

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Get Access

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media