Abstract:Research on side-channel leaks has long been focusing on the information exposure from a single channel (memory, network traffic, power, etc.). Less studied is the risk of learning from multiple side channels related to a target activity (e.g., website visits) even when individual channels are not informative enough for an effective attack. Although the prior research made the first step on this direction, inferring the operations of foreground apps on iOS from a set of global statistics, still less clear are how to determine the maximum information leaks from all target-related side channels on a system, what can be learnt about the target from such leaks and most importantly, how to control information leaks from the whole system, not just from an individual channel. To answer these fundamental questions, we performed the first systematic study on multi-channel inference, focusing on iOS as the first step. Our research is based upon a novel attack technique, called Mischief, which given a set of potential side channels related to a target activity (e.g., foreground apps), utilizes probabilistic search to approximate an optimal subset of the channels exposing most information, as measured by Merit Score, a metric for correlation-based feature selection. On such an optimal subset, an inference attack is modeled as a multivariate time series classification problem, so the state-of-the-art deep-learning based solution, InceptionTime in particular, can be applied to achieve the best possible outcome. Mischief is found to work effectively on today's iOS (16.2), identifying foreground apps, website visits, sensitive IoT operations (e.g., opening the door) with a high confidence, even in an open-world scenario, which demonstrates that the protection Apple puts in place against the known attack is inadequate. Also importantly, this new understanding enables us to develop more comprehensive protection, which could elevate today's side-channel research from suppressing leaks from individual channels to controlling information exposure across the whole system.

Path Leaks of HTTPS Side-Channel by Cookie Injection

Cookies Lack Integrity: Real-World Implications.

Talking with Familiar Strangers: an Empirical Study on HTTPS Context Confusion Attacks

I Know Why You Went to the Clinic: Risks and Realization of HTTPS Traffic Analysis

Side-Channel Information Leakage Of Encrypted Video Stream In Video Surveillance Systems

Side-Channel Information Leakage of Traffic Data in Instant Messaging

The Danger of Minimum Exposures: Understanding Cross-App Information Leaks on iOS through Multi-Side-Channel Learning

HSTS Measurement and an Enhanced Stripping Attack Against HTTPS.

Off-Path Attacking the Web

Timing-Based Browsing Privacy Vulnerabilities Via Site Isolation

Off-Path TCP Hijacking Attacks via the Side Channel of Downgraded IPID

Toward Exposing Timing-Based Probing Attacks in Web Applications

Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack

Leaking secrets in homomorphic encryption with side-channel attacks

BandwidthBreach: Unleashing Covert and Side Channels through Cache Bandwidth Exploitation

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite

A survey and analysis of TLS interception mechanisms and motivations

The Early Bird Catches the Leak: Unveiling Timing Side Channels in LLM Serving Systems

SMoTherSpectre: exploiting speculative execution through port contention

Adaptive Webpage Fingerprinting from TLS Traces

Fingerprinting User Privacy in Web Applications