Software Observable Side Channels

Question 1

Causes of software observable SCs?

Answer 1

Finite total amount (memory, cache size, etc) and finite throughput (number of cache accesses, memory channels, etc)

Question 2

How to get Software Observable SC onto target system?

Answer 2

• time shared system (multi accounts on same device), malicious user can get info about others
• personal computers, cell phones - apps are sandboxed, so malicious app can get info about other apps
• cloud computing - must RE how provider assigns VMs => usually based on resource usage => create VM with matching profile to target

Question 3

what are Memoization-Based Optimizations?

Answer 3

Improve performance based on temporal locality (what recently happened is likely to happen again). Usually table stores the results of a time-consuming operation

Question 4

Types of Memoization-Based Optimizations?

Answer 4

Non-speculative (tagged lookup, i.e. cache) => miss takes longer than a hit
Speculative (i.e. branch prediction) => each entry contains info about params and outcome => misprediction is expensive and causes a penalty

Question 5

general approach to Memoization-Based attack

Answer 5

Premise: parameters of victim’s operation contain sensitive information => sensitive information determines which table entry is used

1. Attacker does operations to occupy specific table entries
2. Depending on sensitive data, victim tries to occupy same entries => evicting attacker’s data
3. Attacker repeats operation and times it to see which entries were evicted

Question 6

how does cache set associativity make a SC harder or easier?

Answer 6

Less entries in a set ==> more information is leaked

Question 7

how to prevent cache side channels?

Answer 7

1. Timing between memory accesses should not depend on sensitive data
2. Addresses of memory accesses should not depend on sensitive data

Question 8

how to measure side channels

Answer 8

• Use system calls to get the time
• Use hardware performance counters (count things such as cache misses)
• Use other hardware tables (TLB, branch pred tables, LLC, cache coherence dirs)