ARMageddon: Cache Attacks on Mobile Devices

By Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clémentine Maurice, Stefan Mangard. USENIX Security Symposium, 2015

463 citations recorded by the source corpus.

In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/55c1aacbbbb4655effa3733275104f92b07eb815

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Fallout: Leaking Data on Meltdown-resistant CPUs (2019, background): “, web server function calls [81], user input [29, 50, 67], kernel addressing information [27], and cryptographic algorithms [6, 8, 19, 43, 64, 80].”
CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management (2017, methodology): “Since we are profiling code execution within Trustzone in a separate core, we use recent advances in the crosscore instruction- and data-based Prime+Probe15 cache attack techniques [31,40,62].”
Drammer: Deterministic Rowhammer Attacks on Mobile Platforms (2016, background): “Lipp et al. [28] demonstrated cache eviction on ARM-based mobile devices, but did not evaluate the possibility of Rowhammer attacks based on cache eviction.”
Spectre Attacks: Exploiting Speculative Execution (2018, unknown): “, Flush+Reload [74] and Evict+Reload [25, 45].”
A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “, on cryptographic algorithms [95, 46, 30], user input [29, 58, 77], and kernel addressing information [28].”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, methodology): “To achieve the highest number of increments, we handcraft a counter thread [31,49] in inline assembly.”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, unknown): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, background): “High-resolution LLC attacks that do not rely on shared memory are a recent development [83,105,107,123].”