Abstract:Interrupts are critical hardware resources for OS kernels to schedule processes. As they are related to system activities, interrupts can be used to mount various side-channel attacks (i.e., monitoring keystrokes, inferring website visits, detecting GPU activities, and fingerprinting processes). Given that all these attacks rely on system file interfaces or architectural timers to probe interrupts, various countermeasures have been proposed to either remove the unprivileged access to the file interfaces or detect/cripple architectural timers. In this work, we propose SegScope, a new technique that abuses segment protection to provision fine-grained interrupt observations without any timer. As segment protection is widely used on x86, SegScope works across a wide range of Intel- and AMD-based CPUs. Particularly, we observe that while segment protection preserves the confidentiality of high privileged domain, it leaves a footprint via the data segment registers values when an interrupt occurs. With this key observation, SegScope is crafted by capturing the footprints. To show its security implications, we evaluate it in four case studies. First, SegScope has inferred website visits with a respective success rate of 92.4% on Chrome and 87.4% on Tor Browser in default system settings. Second, SegScope successfully extracts the keys from Cloudflare's Interoperable Reusable Cryptographic Library (CIRCL) v1.1. Third, SegScope steals DNN model architectures with an accuracy of over 80%. Last, SegScope effectively reduces the noise of interrupts to improve the performance of other side channels. As an example, SegScope reduces the error rate of Spectral side channel by 56x. Compared with existing timer-based interrupt-probing techniques, SegScope is fine-grained without introducing false-positives. Further, we leverage SegScope to craft a fine-grained timer, as regular timer interrupts as clock edges contain timestamps. Our evaluation shows that it achieves the same level of timing granularity as the high-resolution timer, i.e., rdtsc and rdpru. We then leverage the timer to break KASLR in about 10 seconds and mount a Flush+Reload based Spectre attack.

Retrofitting LBR Profiling to Enhance Virtual Machine Introspection

A Virtual Machine Migration Strategy Based on the Relevance of Services Against Side-Channel Attacks

Log-based Architectures for General-Purpose Monitoring of Deployed Code

A Lightweight Live Memory Forensic Approach Based on Hardware Virtualization.

System Call Redirection: A Practical Approach to Meeting Real-World Virtual Machine Introspection Needs

Catch You with Cache: Out-of-VM Introspection to Trace Malicious Executions.

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

ProPatrol: Attack Investigation via Extracted High-Level Tasks

ANOLE: A Profiling-Driven Adaptive Lock Waiter Detection Scheme for Efficient MP-guest Scheduling

Investigating Timing Channel in IaaS

Vapor: Virtual Machine Based Parallel Program Profiling Framework

Active and passive virtual machine introspection on AMD and ARM processors

TRACES: TEE-based Runtime Auditing for Commodity Embedded Systems

Virtual Breakpoints for x86/64

SegScope: Probing Fine-grained Interrupts Via Architectural Footprints

Zebra: Deeply Integrating System-Level Provenance Search and Tracking for Efficient Attack Investigation

DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks

PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

Virtual Machine Introspection Based Malware Behavior Profiling and Family Grouping