Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3460120.3484816acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article

Prime+Scope: Overcoming the Observer Effect for High-Precision Cache Contention Attacks

Published: 13 November 2021 Publication History

Abstract

Modern processors expose software to information leakage through shared microarchitectural state. One of the most severe leakage channels is cache contention, exploited by attacks referred to as PRIME+PROBE, which can infer fine-grained memory access patterns while placing only limited assumptions on attacker capabilities.
In this work, we strengthen the cache contention channel with a near-optimal time resolution. We propose PRIME+SCOPE, a cross-core cache contention attack that performs back-to-back cache contention measurements that access only a single cache line. It offers a time resolution of around 70 cycles (25ns), while maintaining the wide applicability of PRIME+PROBE. To enable such a rapid measurement, we rely on the deterministic nature of modern replacement policies and their (non-)interaction across cache levels. We provide a methodology to, essentially, prepare multiple cache levels simultaneously, and apply it to Intel processors with both inclusive and non-inclusive cache hierarchies. We characterize the resolution of PRIME+SCOPE, and confirm it with a cross-core covert channel (capacity up to 3.5 Mbps, no shared memory) and an improved attack on AES T-tables. Finally, we use the properties underlying PRIME+SCOPE to bootstrap the construction of the eviction sets needed for the attack. The resulting routine outperforms state-of-the-art techniques by two orders of magnitude.
Ultimately, our work shows that interference through cache contention can provide richer temporal precision than state-of-the-art attacks that directly interact with monitored memory addresses.

References

[1]
Andreas Abel and Jan Reineke. 2013. Measurement-based Modeling of the Cache Replacement Policy. In IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS).
[2]
Andreas Abel and Jan Reineke. 2020. nanoBench: a Low-overhead Tool for Running Microbenchmarks on x86 Systems. In IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS).
[3]
Thomas Allan, Billy Bob Brumley, Katrina Falkner, Joop Van de Pol, and Yuval Yarom. 2016. Amplifying Side Channels Through Performance Degradation. In Annual Conference on Computer Security Applications (ACSAC).
[4]
Diego F Aranha, Felipe Rodrigues Novaes, Akira Takahashi, Mehdi Tibouchi, and Yuval Yarom. 2020. Ladderleak: Breaking ECDSA With Less Than One Bit of Nonce Leakage. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[5]
Zelalem Birhanu Aweke, Salessawi Ferede Yitbarek, Rui Qiao, Reetuparna Das, Matthew Hicks, Yossi Oren, and Todd Austin. 2016. ANVIL: Software-based Protection Against Next-generation Rowhammer Attacks. ASPLOS (2016).
[6]
Raad Bahmani, Ferdinand Brasser, Ghada Dessouky, Patrick Jauernig, Matthias Klimmek, Ahmad-Reza Sadeghi, and Emmanuel Stapf. 2021. {CURE}: A Security Architecture with CUstomizable and Resilient Enclaves. In USENIX Security Symposium.
[7]
Mohammad Behnia, Prateek Sahu, Riccardo Paccagnella, Jiyong Yu, Zirui Zhao, Xiang Zou, Thomas Unterluggauer, Josep Torrellas, Carlos Rozas, Adam Morrison, Frank Mckeen, Fangfei Liu, Ron Gabor, ChristopherW. Fletcher, Abhishek Basak, and Alaa Alameldeen. 2021. Speculative Interference Attacks: Breaking Invisible Speculation Schemes. ASPLOS (2021).
[8]
Naomi Benger, Joop Van de Pol, Nigel P Smart, and Yuval Yarom. 2014. ?Ooh Aah... Just a Little Bit": A Small Amount of Side Channel can go a Long Way. In Cryptographic Hardware and Embedded Systems (CHES).
[9]
Daniel J Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal, and Yuval Yarom. 2017. Sliding Right into Disaster: Left-to-right Sliding Windows Leak. In Cryptographic Hardware and Embedded Systems (CHES).
[10]
Samira Briongos, Ida Bruhns, Pedro Malagón, Thomas Eisenbarth, and José M. Moya. 2021. Aim, Wait, Shoot: How the CACHESNIPER Technique Improves Unprivileged Cache Attacks. In IEEE European Symposium on Security and Privacy (EuroS&P).
[11]
Samira Briongos, Pedro Malagon, Jose M. Moya, and Thomas Eisenbarth. 2020. RELOAD+REFRESH: Abusing Cache Replacement Policies to Perform Stealthy Cache Attacks. In USENIX Security Symposium.
[12]
Leon Groot Bruinderink, Andreas Hülsing, Tanja Lange, and Yuval Yarom. 2016. Flush, Gauss, and Reload--a Cache Attack on the BLISS Lattice-based Signature Scheme. In Cryptographic Hardware and Embedded Systems (CHES).
[13]
Lucian Cojocar, Jeremie Kim, Minesh Patel, Lillian Tsai, Stefan Saroiu, Alec Wolman, and Onur Mutlu. 2020. Are We Susceptible to Rowhammer? An Endto- End Methodology for Cloud Providers. In IEEE Symposium on Security and Privacy (S&P).
[14]
Victor Costan, Ilia Lebedev, and Srinivas Devadas. 2016. Sanctum: Minimal Hardware Extensions for Strong Software Isolation. In USENIX Security Symposium.
[15]
Luca De Feo, Bertram Poettering, and Alessandro Sorniotti. 2021. On the (in) security of ElGamal in OpenPGP. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[16]
Finn de Ridder, Pietro Frigo, Emanuele Vannacci, Herbert Bos, Cristiano Giuffrida, and Kaveh Razavi. 2021. SMASH: Synchronized Many-sided Rowhammer Attacks from JavaScript. In USENIX Security Symposium.
[17]
Ghada Dessouky, Tommaso Frassetto, and Ahmad-Reza Sadeghi. 2020. HybCache: Hybrid Side-Channel-Resilient Caches for Trusted Execution Environments. In USENIX Security Symposium.
[18]
Craig Disselkoen, David Kohlbrenner, Leo Porter, and Dean M. Tullsen. 2017. Prime+Abort: A Timer-Free High-Precision L3 Cache Attack using Intel TSX. In USENIX Security Symposium.
[19]
Leonid Domnitser, Aamer Jaleel, Jason Loew, Nael Abu-Ghazaleh, and Dmitry Ponomarev. 2012. Non-Monopolizable Caches: Low-Complexity Mitigation of Cache Side Channel Attacks. ACM Transactions on Architecture and Code Optimization (TACO) (2012).
[20]
Daniel Genkin, Lev Pachmanov, Eran Tromer, and Yuval Yarom. 2018. Drive-by Key-extraction Cache Attacks from Portable Code. In Applied Cryptography and Network Security.
[21]
Daniel Genkin, Luke Valenta, and Yuval Yarom. 2017. May the Fourth be With You: A Microarchitectural Side Channel Attack on Several Real-world Applications of Curve25519. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[22]
Enes Göktas, Kaveh Razavi, Georgios Portokalidis, Herbert Bos, and Cristiano Giuffrida. 2020. Speculative Probing: Hacking Blind in the Spectre Era. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[23]
Daniel Gruss, Julian Lettner, Felix Schuster, Olga Ohrimenko, Istvan Haller, and Manuel Costa. 2017. Strong and Efficient Cache Side-channel Protection Using Hardware Transactional Memory. In USENIX Security Symposium.
[24]
Daniel Gruss, Clémentine Maurice, and Stefan Mangard. 2016. Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA).
[25]
Daniel Gruss, Clémentine Maurice, Klaus Wagner, and Stefan Mangard. 2016. Flush+Flush: A Fast and Stealthy Cache Attack. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA).
[26]
Daniel Gruss, Raphael Spreitzer, and Stefan Mangard. 2015. Cache Template Attacks: Automating Attacks on Inclusive Last-level Caches. In USENIX Security Symposium.
[27]
David Gullasch, Endre Bangerter, and Stephan Krenn. 2011. Cache Games-- Bringing Access-based Cache Attacks on AES to Practice. In IEEE Symposium on Security and Privacy (S&P).
[28]
Berk Gülmezoglu, Mehmet Sinan Inci, Gorka Irazoqui Apecechea, Thomas Eisenbarth, and Berk Sunar. 2015. A Faster and More Realistic Flush+Reload Attack on AES. In Constructive Side-Channel Analysis and Secure Design (COSADE).
[29]
Ralf Hund, Carsten Willems, and Thorsten Holz. 2013. Practical Timing Side Channel Attacks against Kernel Space ASLR. In IEEE Symposium on Security and Privacy (S&P).
[30]
Intel. 2019. Intel Transactional Synchronization Extensions (Intel TSX) Asynchronous Abort. https://software.intel.com/security-software-guidance/deepdives/ deep-dive-intel-transactional-synchronization-extensions-intel-tsxasynchronous- abort.
[31]
Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar. 2015. S$A: A Shared Cache Attack ThatWorks Across Cores and Defies VM Sandboxing -- and Its Application to AES. In IEEE Symposium on Security and Privacy (S&P).
[32]
Gorka Irazoqui, Mehmet Sinan Inci, Thomas Eisenbarth, and Berk Sunar. 2014. Wait a minute! A fast, Cross-VM attack on AES. In Research in Attacks, Intrusions, and Defenses (RAID).
[33]
Michael Kurth, Ben Gras, Dennis Andriesse, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. 2020. NetCAT: Practical Cache Attacks From the Network. In IEEE Symposium on Security and Privacy (S&P).
[34]
Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clémentine Maurice, and Stefan Mangard. 2016. ARMageddon: Cache Attacks on Mobile Devices. In USENIX Security Symposium.
[35]
Fangfei Liu, Qian Ge, Yuval Yarom, Frank Mckeen, Carlos Rozas, Gernot Heiser, and Ruby B Lee. 2016. Catalyst: Defeating Last-level Cache Side Channel Attacks in Cloud Computing. In IEEE International Symposium on High Performance Computer Architecture (HPCA).
[36]
Fangfei Liu and Ruby B. Lee. 2014. Random Fill Cache Architecture. In IEEE/ACM International Symposium on Microarchitecture (MICRO).
[37]
Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby B. Lee. 2015. Last- Level Cache Side-Channel Attacks Are Practical. In IEEE Symposium on Security and Privacy (S&P).
[38]
Clémentine Maurice, Christoph Neumann, Olivier Heen, and Aurélien Francillon. 2015. C5: Cross-Cores Cache Covert Channel. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA).
[39]
Clémentine Maurice, ManuelWeber, Michael Schwarz, Lukas Giner, Daniel Gruss, Carlo Alberto Boano, Stefan Mangard, and Kay Römer. 2017. Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud. In Network and Distributed System Security Symposium (NDSS).
[40]
Ahmad Moghimi, Gorka Irazoqui, and Thomas Eisenbarth. 2017. CacheZoom: How SGX Amplifies the Power of Cache Attacks. In Cryptographic Hardware and Embedded Systems (CHES).
[41]
Yossef Oren, Vasileios P. Kemerlis, Simha Sethumadhavan, and Angelos D. Keromytis. 2015. The Spy in the Sandbox: Practical Cache Attacks in JavaScript and Their Implications. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[42]
Dag Arne Osvik, Adi Shamir, and Eran Tromer. 2006. Cache Attacks and Countermeasures: The Case of AES. In Cryptographers' Track at the RSA Conference on Topics in Cryptology (CT-RSA).
[43]
Riccardo Paccagnella, Licheng Luo, and Christopher W. Fletcher. 2021. Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical. In USENIX Security Symposium.
[44]
Peter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz, and Stefan Mangard. 2016. DRAMA: Exploiting DRAM Addressing for Cross-cpu Attacks. In USENIX Security Symposium.
[45]
Moinuddin K. Qureshi. 2018. CEASER: Mitigating Conflict-based Cache Attacks via Encrypted-address and Remapping. In IEEE/ACM International Symposium on Microarchitecture (MICRO).
[46]
Moinuddin K. Qureshi. 2019. New Attacks and Defense for Encrypted-address Cache. In International Symposium on Computer Architecture (ISCA).
[47]
Thomas Ristenpart, Eran Tromer, Hovav Shacham, and Stefan Savage. 2009. Hey, You, Get off of My Cloud: Exploring Information Leakage in Third-party Compute Clouds. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[48]
Stephen Röttger and Artur Janc. 2021. A Spectre proof-of-concept for a Spectre-proof web. https://github.com/google/security-research-pocs/tree/ master/spectre.js.
[49]
Gururaj Saileshwar and Moinuddin Qureshi. 2021. MIRAGE: Mitigating Conflict- Based Cache Attacks with a Practical Fully-Associative Design. In USENIX Security Symposium.
[50]
Michael Schwarz, Moritz Lipp, Daniel Moghimi, Jo Van Bulck, Julian Stecklina, Thomas Prescher, and Daniel Gruss. 2019. ZombieLoad: Cross-Privilege- Boundary Data Sampling. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[51]
Michael Schwarz, Samuel Weiser, Daniel Gruss, Clémentine Maurice, and Stefan Mangard. 2017. Malware Guard Extension: Using SGX to Conceal Cache Attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA).
[52]
Anatoly Shusterman, Ayush Agarwal, Sioli O'Connell, Daniel Genkin, Yossi Oren, and Yuval Yarom. 2021. Prime+Probe 1, JavaScript 0: Overcoming Browser-based Side-Channel Defenses. In USENIX Security Symposium.
[53]
Anatoly Shusterman, Lachlan Kang, Yarden Haskal, Yosef Meltser, Prateek Mittal, Yossi Oren, and Yuval Yarom. 2019. Robust Website Fingerprinting Through the Cache Occupancy Channel. In USENIX Security Symposium.
[54]
Qinhan Tan, Zhihua Zeng, Kai Bu, and Kui Ren. 2020. PhantomCache: Obfuscating Cache Conflicts with Localized Randomization. In Network and Distributed System Security Symposium (NDSS).
[55]
Eran Tromer, Dag Arne Osvik, and Adi Shamir. 2010. Efficient Cache Attacks on AES, and Countermeasures. Journal of Cryptology (2010).
[56]
Jo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza, Frank Piessens, and Raoul Strackx. 2017. Telling Your Secrets Without Page Faults: Stealthy Page Tablebased Attacks on Enclaved Execution. In USENIX Security Symposium.
[57]
Stephan Van Schaik, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. 2018. Malicious management unit: Why stopping cache attacks in software is harder than you think. In USENIX Security Symposium.
[58]
Stephan Van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2019. RIDL: Rogue In-flight Data Load. In IEEE Symposium on Security and Privacy (S&P).
[59]
Pepe Vila, Pierre Ganty, Marco Guarnieri, and Boris Köpf. 2020. CacheQuery: Learning replacement policies from hardware caches. In ACM SIGPLAN Conference on Programming Language Design and Implementation.
[60]
Pepe Vila, Boris Köpf, and José F. Morales. 2019. Theory and Practice of Finding Eviction Sets. In IEEE Symposium on Security and Privacy (S&P).
[61]
Daimeng Wang, Zhiyun Qian, Nael Abu-Ghazaleh, and Srikanth V Krishnamurthy. 2019. Papp: Prefetcher-aware Prime and Probe Side-channel Attack. In Design Automation Conference (DAC).
[62]
Zhenghong Wang and Ruby B. Lee. 2007. New Cache Designs for Thwarting Software Cache-based Side Channel Attacks. In International Symposium on Computer Architecture (ISCA).
[63]
Mario Werner, Thomas Unterluggauer, Lukas Giner, Michael Schwarz, Daniel Gruss, and Stefan Mangard. 2019. SCATTERCACHE: Thwarting Cache Attacks via Cache Set Randomization. In USENIX Security Symposium.
[64]
Wenjie Xiong and Jakub Szefer. 2020. Leaking Information Through Cache LRU States. In IEEE Symposium on High Performance Computer Architecture (HPCA).
[65]
Mengjia Yan, Read Sprabery, Bhargava Gopireddy, ChristopherW. Fletcher, Roy H. Campbell, and Josep Torrellas. 2019. Attack Directories, Not Caches: Side Channel Attacks in a Non-Inclusive World. In IEEE Symposium on Security and Privacy (S&P).
[66]
Yuval Yarom and Naomi Benger. 2014. Recovering OpenSSL ECDSA Nonces Using the FLUSH+ RELOAD Cache Side-channel Attack. IACR Cryptol. ePrint Arch. 2014/140 (2014).
[67]
Yuval Yarom and Katrina Falkner. 2014. FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-channel Attack. In USENIX Security Symposium.
[68]
Yinqian Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2012. Cross- VM Side Channels and their use to Extract Private Keys. In ACM SIGSAC Conference on Computer and Communications Security (CCS).
[69]
Yinqian Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2014. Crosstenant Side-channel Attacks in PaaS Clouds. In ACM SIGSAC Conference on Computer and Communications Security (CCS).

Cited By

View all
  • (2024)DeepCache: Revisiting Cache Side-Channel Attacks in Deep Neural Networks ExecutablesProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3690241(4495-4508)Online publication date: 2-Dec-2024
  • (2024)TF-Timer: Mitigating Cache Side-Channel Attacks in Cloud through a Targeted Fuzzy Timer2024 IEEE Wireless Communications and Networking Conference (WCNC)10.1109/WCNC57260.2024.10571330(1-6)Online publication date: 21-Apr-2024
  • (2024)Write+Sync: Software Cache Write Covert Channels Exploiting Memory-Disk SynchronizationIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.341425519(8066-8078)Online publication date: 2024
  • Show More Cited By

Index Terms

  1. Prime+Scope: Overcoming the Observer Effect for High-Precision Cache Contention Attacks

      Recommendations

      Comments

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security
      November 2021
      3558 pages
      ISBN:9781450384544
      DOI:10.1145/3460120
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 13 November 2021

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. cache attacks
      2. cache side channels
      3. microarchitecture

      Qualifiers

      • Research-article

      Funding Sources

      • European Research Council
      • CyberSecurity Research Flanders

      Conference

      CCS '21
      Sponsor:
      CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security
      November 15 - 19, 2021
      Virtual Event, Republic of Korea

      Acceptance Rates

      Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

      Upcoming Conference

      CCS '25

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)197
      • Downloads (Last 6 weeks)24
      Reflects downloads up to 28 Dec 2024

      Other Metrics

      Citations

      Cited By

      View all
      • (2024)DeepCache: Revisiting Cache Side-Channel Attacks in Deep Neural Networks ExecutablesProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3690241(4495-4508)Online publication date: 2-Dec-2024
      • (2024)TF-Timer: Mitigating Cache Side-Channel Attacks in Cloud through a Targeted Fuzzy Timer2024 IEEE Wireless Communications and Networking Conference (WCNC)10.1109/WCNC57260.2024.10571330(1-6)Online publication date: 21-Apr-2024
      • (2024)Write+Sync: Software Cache Write Covert Channels Exploiting Memory-Disk SynchronizationIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.341425519(8066-8078)Online publication date: 2024
      • (2024)RECAST: Mitigating Conflict-Based Cache Attacks Through Fine-Grained Dynamic MappingIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.336886219(3758-3771)Online publication date: 2024
      • (2024)Randomizing Set-Associative Caches Against Conflict-Based Cache Side-Channel AttacksIEEE Transactions on Computers10.1109/TC.2024.334965973:4(1019-1033)Online publication date: 8-Jan-2024
      • (2024)Efficient and Generic Microarchitectural Hash-Function Recovery2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00028(3661-3678)Online publication date: 19-May-2024
      • (2024)Analyzing Cache Timing-based Side Channel Vulnerability through Cache Line CompositionMILCOM 2024 - 2024 IEEE Military Communications Conference (MILCOM)10.1109/MILCOM61039.2024.10773698(517-522)Online publication date: 28-Oct-2024
      • (2024)TLTracer: Dynamically Detecting Cache Side Channel Attacks with a Timing Loop TracerICC 2024 - IEEE International Conference on Communications10.1109/ICC51166.2024.10622283(109-114)Online publication date: 9-Jun-2024
      • (2024)Cips: The Cache Intrusion Prevention SystemComputer Security – ESORICS 202410.1007/978-3-031-70903-6_1(3-23)Online publication date: 5-Sep-2024
      • (2023)Uncore Encore: Covert Channels Exploiting Uncore Frequency ScalingProceedings of the 56th Annual IEEE/ACM International Symposium on Microarchitecture10.1145/3613424.3614259(843-855)Online publication date: 28-Oct-2023
      • Show More Cited By

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media