Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches

By Daniel Gruss, Raphael Spreitzer, Stefan Mangard. USENIX Security Symposium, 2015

508 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/70fb3cea8335aefdf849597e9d9dd7512d722d88

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution (2017, background): “In a more general, non-PMA context, there exists a vast amount of research on microarchitectural cache timing vulnerabilities [35, 50, 17].”
Packet Chasing: Spying on Network Packets over a Cache Side-Channel (2019, unknown): “…attacks, also known as cache attacks, are the most common class of architectural timing channels, and are shown to be successful at building covert communication channels [23, 24], revealing secret information such as cryptography keys [24–27], keystroke [28], and web browsing data [29, 30].”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, background): “, web server function calls [81], user input [29, 50, 67], kernel addressing information [27], and cryptographic algorithms [6, 8, 19, 43, 64, 80].”
A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “However, these latency differences can be exploited in side-channels and covert channels [53, 70, 95, 29, 63].”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, background): “Furthermore, as already known from previous attacks, the hardware prefetcher can induce a signiﬁcant amount of noise [23], [24] ] ; element with max. counter ; end time of 0 .”
Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures (2018, background): “Recent works also target application fingerprinting [28, 42, 48, 50, 73] to steal web content or server data, monitor user behavior [22, 36, 46, 71], and break system protection mechanisms such as SGX and KASLR [11, 21, 61].”
Peeking Behind the Curtains of Serverless Platforms (2018, background): “Cross-tenant VM sharing in Azure plus the ability to run arbitrary binaries in the function instance could make applications vulnerable to many kinds of side-channel attacks [16, 17, 20, 45].”
Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu (2017, background): “A cache-based side channel can be constructed using data caches (including per-core L2 uniﬁed caches) on shared processors [39, 47, 20, 23], instruction caches [5, 58], shared last-level caches (LLC) [55, 59, 33, 18, 40, 25].”
Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization (2019, background): “Cache-based side-channel attacks have been shown to reveal secret information such as cryptographic keys [36, 82, 27], keystrokes [35], and browsing activity [60] by co-locating a spy process alongside a victim in such a way that they share cache memory.”
ARMageddon: Cache Attacks on Mobile Devices (2015, methodology): “We implement cache template attacks [20] to create and exploit accurate cache-usage profiles using the Evict+Reload or Flush+Reload attack.”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, methodology): “Gruss et al. [63] further generalised the Flush+Reload technique with a pre-computed cache template matrix, a technique that pro-ﬁles and exploits cache-based side channels automatically.”
Software Grand Exposure: SGX Cache Attacks Are Practical (2017, background): “Since cache attacks on cryptographic algorithms are well understood from previous literature [43, 39, 30, 36, 54, 21, 20], we only summarize our RSA attack here.”
Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript (2015, methodology): “Cache lines are flushed with the clflush instruction or using cache eviction [13].”
CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management (2017, methodology): “Since we are profiling code execution within Trustzone in a separate core, we use recent advances in the crosscore instruction- and data-based Prime+Probe15 cache attack techniques [31,40,62].”
DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks (2015, methodology): “Based on this attack principle, we build a fully automated template attack [6] that triggers an event in the victim process running on the other core or CPU (e.”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, methodology): “Cache Template Attacks [10] can be used to detect attacks on shared libraries and binaries as a user.”
Meltdown: Reading Kernel Memory from User Space (2018, background): “, cryptographic algorithms [23], web server function calls [24], user input [6], and kernel addressing information [4].”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, unknown): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”