Abstract:High-assurance embedded systems are deployed for decades and expensive to re-certify – hence, each new attack is an unpatchable problem that can only be detected by monitoring out-of-band channels such as the system’s power trace or electromagnetic emissions. Micro-Architectural attacks, for example, have recently come to prominence since they break all existing software-isolation based security – for example, by hammering memory rows to gain root privileges or by abusing speculative execution and shared hardware to leak secret data. This work is the first to use anomalies in an embedded system’s power trace to detect evasive micro-architectural attacks. To this end, we introduce power-mimicking micro-architectural attacks – including DRAM-rowhammer attacks, side/covert-channel and speculation-driven attacks – to study their evasiveness. We then quantify the operating range of the power-anomalies detector using the Odroid XU3 board – showing that rowhammer attacks cannot evade detection while covert channel and speculation-driven attacks can evade detection but are forced to operate at a 36 × and 7 × lower bandwidth . Our power-anomaly detector is efficient and can be embedded-of-band into (e.g.,) programmable batteries. While rowhammer, side-channel, and speculation-driven attack defenses require invasive code- and hardware-changes in general-purpose systems, we show that power-anomalies are a simple and effective defense for embedded systems. Power-anomalies can help future-proof embedded systems against vulnerabilities that are likely to emerge as new hardware like phase-change memories and accelerators become mainstream.

Security breaches as PMU deviation: detecting and identifying security attacks using performance counters

PMU-Spill: A New Side Channel for Transient Execution Attacks

PMU-Leaker: Performance Monitor Unit-based Realization of Cache Side-Channel Attacks

PMU-Spill: Performance Monitor Unit Counters Leak Secrets in Transient Executions

WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices

PMUSpill: The Counters in Performance Monitor Unit that Leak SGX-Protected Secrets

Cfimon: Detecting Violation Of Control Flow Integrity Using Performance Counters

Defending Against Adversarial Attacks in Transmission- and Distribution-level PMU Data

Exploration and Exploitation of Hidden PMU Events

TPE-Det: A Tamper-Proof External Detector via Hardware Traces Analysis Against IoT Malware

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

Using Power-Anomalies to Counter Evasive Micro-Architectural Attacks in Embedded Systems

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters

Hardware-Assisted Monitoring For Instruction Security In Embedded System

A Survey of Cyber Security Countermeasures Using Hardware Performance Counters

EPA-RIMM: A Framework for Dynamic SMM-based Runtime Integrity Measurement

Profiling with trust: system monitoring from trusted execution environments

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

DESIGN OF SECURITY MONITOR MODULE AT RUNTIME BASED ON DYNAMIC INFORMATION FLOW TRACKING

Anomaly Detection for malware identification using Hardware Performance Counters