Yet another MicroArchitectural Attack:: exploiting I-Cache

By Onur Aciiçmez. Workshop on Computer Security Architecture, 2007

295 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/92d1a8ccaf86452f5e91fea1f318ff5d866dacaf

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

Citations in the corpus

The Spy in the Sandbox - Practical Cache Attacks in Javascript (2015, background): “…attack is the most well-known representative of the general class of micro-architectural attacks, which are deﬁned by Aciiï¿œmez in his excellent survey [2] as attacks which “exploit deeper processor ingredients below the trust architecture boundary” to recover secrets from various secure systems.”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “In Prime-Probe attacks [1, 37, 48, 53, 55, 56, 70, 86], by pre-loading cache lines in a cache set, the adversary expects that her future memory accesses (to the same memory) will be served by the cache, unless evicted by the victim program.”
FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack (2014, background): “Using a cache side-channel to trace the execution of a program is not a new idea [1, 2, 4, 14, 19, 29, 61].”
Last-Level Cache Side-Channel Attacks are Practical (2015, methodology): “This technique has been used for attacks against several processor caches, including the L1 data cache [28, 31, 34, 47], L1 instruction cache [1, 2, 4] and the branch prediction cache [3].”
S$A: A Shared Cache Attack That Works across Cores and Defies VM Sandboxing -- and Its Application to AES (2015, background): “The offsets allow addressing within a memory page.”
Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu (2017, background): “A cache-based side channel can be constructed using data caches (including per-core L2 unified caches) on shared processors [39, 47, 20, 23], instruction caches [5, 58], shared last-level caches (LLC) [55, 59, 33, 18, 40, 25].”
Wait a Minute! A fast, Cross-VM Attack on AES (2014, background): “Acıiçmez in [4] was the first one discovering that the instruction cache as well as the data cache leaked information when performing RSA encryption.”
A Hardware Design Language for Timing-Sensitive Information-Flow Security (2015, background): “Attacks have also been shown that exploit timing channels arising from other components: instruction and data caches [2], branch predictors and branch target buffers [3], and shared functional units [44].”
CacheBleed: a timing attack on OpenSSL constant-time RSA (2016, background): “Persistent-state channels have targeted the L1 data cache [9,17,45,46], the L1 instruction cache [1,5,56], the branch prediction buffer [3,4], the last-level cache [31,33,40,51,54], and DRAM open rows [47].”
Spectre Attacks: Exploiting Speculative Execution (2018, background): “Over the years, channels have been demonstrated over multiple microarchitectural components, including the instruction cache [3], lower level caches [30, 38, 48, 74], the BTB [14, 44], and branch history [1, 2].”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, unknown): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”