CISPA
Browse
cispa_all_3483.pdf (311.36 kB)

Rapid Prototyping for Microarchitectural Attacks

Download (311.36 kB)
conference contribution
posted on 2023-11-29, 18:19 authored by Catherine Easdon, Michael SchwarzMichael Schwarz, Martin Schwarzl, Daniel Gruss
In recent years, microarchitectural attacks have been demonstrated to be a powerful attack class. However, as our empirical analysis shows, there are numerous implementation challenges that hinder discovery and subsequent mitigation of these vulnerabilities. In this paper, we examine the attack development process, the features and usability of existing tools, and the real-world challenges faced by practitioners. We propose a novel approach to microarchitectural attack development, based on rapid prototyping, and present two open-source software frameworks, libtea and SCFirefox, that improve upon state-of-the-art tooling to facilitate rapid prototyping of attacks. libtea demonstrates that native code attacks can be abstracted sufficiently to permit cross-platform implementations while retaining fine-grained control of microarchitectural behavior. We evaluate its effectiveness by developing proof-of-concept Foreshadow and LVI attacks. Our LVI prototype runs on x86-64 and ARMv8-A, and is the first public demonstration of LVI on ARM. SCFirefox is the first tool for browser-based microarchitectural attack development, providing the functionality of libtea in JavaScript. This functionality can then be used to iteratively port a prototype to unmodified browsers. We demonstrate this process by prototyping the first browser-based ZombieLoad attack and deriving a vanilla JavaScript and WebAssembly PoC running in an unmodified recent version of Firefox. We discuss how libtea and SCFirefox contribute to the security landscape by providing attack researchers and defenders with frameworks to prototype attacks and assess their feasibility.

History

Preferred Citation

Catherine Easdon, Michael Schwarz, Martin Schwarzl and Daniel Gruss. Rapid Prototyping for Microarchitectural Attacks. In: Usenix Security Symposium (USENIX-Security). 2022.

Primary Research Area

  • Threat Detection and Defenses

Name of Conference

Usenix Security Symposium (USENIX-Security)

Legacy Posted Date

2021-10-06

Open Access Type

  • Green

BibTeX

@inproceedings{cispa_all_3483, title = "Rapid Prototyping for Microarchitectural Attacks", author = "Easdon, Catherine and Schwarz, Michael and Schwarzl, Martin and Gruss, Daniel", booktitle="{Usenix Security Symposium (USENIX-Security)}", year="2022", }

Usage metrics

    Categories

    No categories selected

    Exports

    RefWorks
    BibTeX
    Ref. manager
    Endnote
    DataCite
    NLM
    DC