Cross-Tenant Side-Channel Attacks in PaaS Clouds

By Yinqian Zhang, Ari Juels, Michael K. Reiter, Thomas Ristenpart. Conference on Computer and Communications Security, 2014

399 citations recorded by the source corpus.

We present a new attack framework for conducting cache-based side-channel attacks and demonstrate this framework in attacks between tenants on commercial Platform-as-a-Service (PaaS) clouds. Our framework uses the FLUSH-RELOAD attack of Gullasch et al. as a primitive, and extends this work by leveraging it within an automaton-driven strategy for tracing a victim's execution. We leverage our framework first to confirm co-location of tenants and then to extract secrets across tenant boundaries. We specifically demonstrate attacks to collect potentially sensitive application data (e.g., the number of items in a shopping cart), to hijack user accounts, and to break SAML single sign-on. To the best of our knowledge, our attacks are the first granular, cross-tenant, side-channel attacks successfully demonstrated on state-of-the-art commercial clouds, PaaS or otherwise.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b751c99f2a7f4824d64160db6f4c11b8c7f6c29d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Peeking Behind the Curtains of Serverless Platforms (2018, background): “Cross-tenant VM sharing in Azure plus the ability to run arbitrary binaries in the function instance could make applications vulnerable to many kinds of side-channel attacks [16, 17, 20, 45].”
Flush+Flush: A Fast and Stealthy Cache Attack (2015, background): “Applications of Flush+Reload have been shown to be reliable and powerful, mainly to attack cryptographic algorithms [12,17,18,47].”
Meltdown: Reading Kernel Memory from User Space (2018, background): “, cryptographic algorithms [23], web server function calls [24], user input [6], and kernel addressing information [4].”
Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems (2015, methodology): “Going beyond the control flow technique of [51], two of our three attacks rely critically on tracking data flow (e.”
The Spy in the Sandbox - Practical Cache Attacks in Javascript (2015, background): “Such a machine is not typically configured to accept interactive input, and accordingly most works in this field focus on the recovery of cryptographic keys or other secret state elements, such as random number generator states [26].”
High-Resolution Side Channels for Untrusted Operating Systems (2017, neutral): “Recently, the flush-and-reload method has enabled an array of stronger attacks [10, 25, 42, 45, 46].”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, neutral): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”
Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches (2015, background): “The restriction of the clflush instruction has been suggested as a possible countermeasure against cache attacks in [55, 56, 59].”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, background): “s (to the same memory) will be served by the cache, unless evicted by the victim program. Therefore, cache misses will reveal the victim’s cache usage of the target cache set. In FLUSH-RELOAD attacks [26, 82, 81, 12, 85, 9], the adversary shares some physical memory pages (e.g., throughdynamicshared”
Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures (2018, methodology): “We assume the attacker process can use techniques from prior work [24, 25] to co-locate onto the same processor chip as the victim process running DNN inference.”
Last-Level Cache Side-Channel Attacks are Practical (2015, methodology): “The same technique has been used in other scenarios [5, 22, 35, 44, 48].”
CacheZoom: How SGX Amplifies The Power of Cache Attacks (2017, background): “Further, cache attacks are capable of extracting information from non-cryptographic applications [57].”
S$A: A Shared Cache Attack That Works across Cores and Defies VM Sandboxing -- and Its Application to AES (2015, background): “Therefore, using huge pages makes it possible to reach a higher resolution Prime+Probe style attack.”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “attacks [20], [91], [92], [7], [95], [4], the adversary shares some physical memory pages (e.”
Preventing Page Faults from Telling Your Secrets (2016, methodology): “Timing and cache attacks have been used to by-pass kernel space ASLR [29], VMs [30], android applications [31], cloud servers [55] and users [40] both locally and remotely [14].”
Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu (2017, background): “A cache-based side channel can be constructed using data caches (including per-core L2 uniﬁed caches) on shared processors [39, 47, 20, 23], instruction caches [5, 58], shared last-level caches (LLC) [55, 59, 33, 18, 40, 25].”