The Spy in the Sandbox - Practical Cache Attacks in Javascript

By Yossef Oren, V. Kemerlis, Simha Sethumadhavan, Angelos Dennis Keromytis. arXiv.org, 2015

350 citations recorded by the source corpus.

We present the first micro-architectural side-channel attack which runs entirely in the browser. In contrast to other works in this genre, this attack does not require the attacker to install any software on the victim’s machine ‐ to facilitate the attack, the victim needs only to browse to an untrusted webpage with attacker-controlled content. This makes the attack model highly scalable and extremely relevant and practical to today’s web, especially since most desktop browsers currently accessing the Internet are vulnerable to this attack. Our attack, which is an extension of the last-level cache attacks of Yarom et al. [23], allows a remote adversary recover information belonging to other processes, other users and even other virtual machines running on the same physical host as the victim web browser. We describe the fundamentals behind our attack, evaluate its performance using a high bandwidth covert channel and finally use it to construct a system-wide mouse/network activity logger. Defending against this attack is possible, but the required countermeasures can exact an impractical cost on other benign uses of the web browser and of the computer.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c98e323bb4689cb509a318f31989dd097d9015f2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Packet Chasing: Spying on Network Packets over a Cache Side-Channel (2019, neutral): “For example, in the PRIME+PROBE [24], [32] attack, the spy process infers the secret by learning the temporal secret-dependent cache access patterns of a victim, by contending for the same cache sets as the victim and measuring the timing variations that arise due to such contention.”
CacheZoom: How SGX Amplifies The Power of Cache Attacks (2017, neutral): “Symmetric keys can be generated at runtime from a secure random entropy (using RDRAND instruction) and/or transferred through a public secure channel without the attacker knowledge.”
Sanctum: Minimal Hardware Extensions for Strong Software Isolation (2016, background): “Recently, [41] demonstrated a cache timing attack that uses JavaScript code in a page visited by a web browser.”
Spectre Attacks: Exploiting Speculative Execution (2018, methodology): “Since the clflush instruction is not accessible from JavaScript, we use cache eviction instead [27, 51], i.”
Intel SGX Explained (2016, methodology): “Furthermore, cache timing attacks were recently demonstrated using JavaScript code in a page visited by a Web browser [145].”
Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures (2018, background): “Recent works also target application fingerprinting [28, 42, 48, 50, 73] to steal web content or server data, monitor user behavior [22, 36, 46, 71], and break system protection mechanisms such as SGX and KASLR [11, 21, 61].”
Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu (2017, background): “A cache-based side channel can be constructed using data caches (including per-core L2 uniﬁed caches) on shared processors [39, 47, 20, 23], instruction caches [5, 58], shared last-level caches (LLC) [55, 59, 33, 18, 40, 25].”
A Formal Foundation for Secure Remote Execution of Enclaves (2017, background): “These attacks are viable at any privilege, separated by arbitrary protection boundaries [31, 42, 52].”
Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches (2015, background): “Simultaneous to our work, Oren et al. [39] developed a cache attack from within sandboxed JavaScript to attack user-specific data like network traffic or mouse movements.”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, neutral): “, access driven attacks [17]) have been demonstrated on x86 architectures, including data caches (and also per-core L2 unified caches) [31], [30], [28], [36], [17], [18], instruction caches [8], [9], [43], and inclusive LLCs [41], [40], [12], [44], [22], [27], [20], [16], [29], [19], [23], [26], [42”
Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, methodology): “To reverse engineer the hash, we ﬁrst collect minimal eviction sets, following the procedure from [42].”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, methodology): “[54] uses a slow pointer-chasing approach and needs to find an eviction set without any assumptions, consuming more time.”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, methodology): “As JavaScript does not provide a method to flush an address from the cache, we have to resort to eviction, as shown in previous work [22, 47, 61, 69, 77].”
A survey of microarchitectural timing attacks and countermeasures on contemporary hardware (2016, background): “High-resolution LLC attacks that do not rely on shared memory are a recent development [83,105,107,123].”
DAWG: A Defense Against Cache Timing Attacks in Speculative Execution Processors (2018, background): “demonstrated [39] to automatically exfiltrate private information upon a web page visit.”