Abstract:Many modern processors have embedded hardware tracing techniques (e.g., Intel Processor Trace or ARM CoreSight). While these techniques are widely used due to their transparency and low overhead, they also bring serious security threats. Attackers can utilize hardware tracing to trace the trusted applications from a non-secure application. Existing protection techniques fail to effectively protect the runtime information when hardware tracing is employed. To counter these threats, in this paper, we propose a novel direction called anti-hardware tracing. Our key idea is to exploit the limitations of hardware tracing: trace buffer overflow can cause trace data loss. We build a model to analyse the overflow and outline three principles for efficient triggering overflows and achieving anti-hardware tracing: numerous branches in the program, high-speed execution of the program, and the high-water mark of the trace buffer. We develop a framework called Armor on ARM Juno R2 to realize our approach. Armor protects software against the trace unit Embedded Trace Macrocell (ETM) in CoreSight by instrumenting protection and loop functions. The protection function detects runtime environments, efficiently fills the trace buffer, and employs various protection strategies like PID (process identifier) replacement and PIE+STRIP+ASLR. Meanwhile, the loop function triggers overflows efficiently based on context-based calculations and anti-ETM loop. Our evaluation demonstrates that the overhead of Armor is 77.31% lower than that of OLLVM [1] on SPEC2006. Armor effectively hides 54.51% of basic blocks across 16 real-world applications, triggering 113× more overflows. Moreover, we showcase two practical applications of Armor. Firstly, we conduct a cryptographic and cross-world attack on GnuPG 1.4.13 RSA private keys using ETM, which can steal entire keys from a program in the Secure world with a single run. Armor successfully reduces leaked bits by 84.5%. Secondly, Armor impedes hardware-assisted fuzzing by reducing throughput by 89.71% and branch coverage by 47.99%.

Hardware-Assisted Monitoring For Instruction Security In Embedded System

Hardware-Assisted Security Monitoring Unit for Real-Time Ensuring Secure Instruction Execution and Data Processing in Embedded Systems

Securing Embedded System from Code Reuse Attacks: A Lightweight Scheme with Hardware Assistance

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Hardware Trojans in Chips: A Survey for Detection and Prevention

Security Protection and Checking in Embedded System Integration Against Buffer Overflow Attacks

RDAMS: an Efficient Run-Time Approach for Memory Fault and Hardware Trojans Detection

Partial Reconfiguration for Run-time Memory Faults and Hardware Trojan Attacks Detection

A Multi-Level Architecture for Hardware Trojan and Vulnerability Runtime Detection and Response Towards Cryptographic IP.

Using Power-Anomalies to Counter Evasive Micro-Architectural Attacks in Embedded Systems

Security protection and checking for embedded system integration against buffer overflow attacks via hardware/software

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

Don't CWEAT It: Toward CWE Analysis Techniques in Early Stages of Hardware Design

Mitigating Code-Reuse Attacks On Cisc Architectures In A Hardware Approach

Armlock: Hardware-Based Fault Isolation For Arm

Jintide: Utilizing Low-Cost Reconfigurable External Monitors to Substantially Enhance Hardware Security of Large-Scale CPU Clusters

Armor: Protecting Software Against Hardware Tracing Techniques

Architecture Support for Memory Confidentiality and Integrity in Embedded Systems

Security Memory System for Mobile Device or Computer Against Memory Attacks

Trusted Platform Module Countermeasures Against Hardware Attacks