cash attacks on sgx

Cash Attacks on SGX Daniel Gruss, Michael Schwarz September 9, 2017 - PowerPoint PPT Presentation

SCIENCE PASSION TECHNOLOGY Cash Attacks on SGX Daniel Gruss, Michael Schwarz September 9, 2017 Graz University of Technology Outline www.tugraz.at 2 Daniel Gruss, Michael Schwarz Graz University of Technology Outline www.tugraz.at 2


  1. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space Step 0 : Attacker fills the cache (prime) 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  2. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space loads data Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  3. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space loads data Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  4. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space a t a l o a d s d Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  5. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space a t a l o a d s d Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  6. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  7. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data Step 2 : Attacker probes data to determine if the set was accessed 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  8. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space fast access Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data Step 2 : Attacker probes data to determine if the set was accessed 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  9. Prime+Probe www.tugraz.at Attacker Victim Cache address space address space slow access Step 0 : Attacker fills the cache (prime) Step 1 : Victim evicts cache lines by accessing own data Step 2 : Attacker probes data to determine if the set was accessed 8 Daniel Gruss, Michael Schwarz — Graz University of Technology

  10. Attack

  11. Attack Settings www.tugraz.at Victim 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  12. Attack Settings www.tugraz.at Victim SGX 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  13. Attack Settings www.tugraz.at Victim SGX Transaction Signature + private key Wallet API 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  14. Attack Settings www.tugraz.at Attacker Victim SGX Transaction Signature + private key Wallet API 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  15. Attack Settings www.tugraz.at Attacker Victim SGX SGX Transaction Signature + private key Wallet API 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  16. Attack Settings www.tugraz.at Attacker Victim SGX SGX Key Transaction Signature Extractor + private key Loader Wallet API 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  17. Attack Settings www.tugraz.at Attacker Victim SGX SGX Key Transaction Signature Extractor + private key Loader Wallet API 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  18. Attack Settings www.tugraz.at Attacker Victim SGX SGX Key Transaction Signature Extractor + private key Loader Wallet API L1/L2 Cache L1/L2 Cache 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  19. Attack Settings www.tugraz.at Attacker Victim SGX SGX Key Transaction Signature Extractor ( Prime+Probe ) + private key Loader Wallet API L1/L2 Cache L1/L2 Cache Shared LLC 9 Daniel Gruss, Michael Schwarz — Graz University of Technology

  20. SGX Limitations www.tugraz.at Classical Prime+Probe cannot be mounted within SGX: 10 Daniel Gruss, Michael Schwarz — Graz University of Technology

  21. SGX Limitations www.tugraz.at Classical Prime+Probe cannot be mounted within SGX: • No access to high-precision timer ( rdtsc ) 10 Daniel Gruss, Michael Schwarz — Graz University of Technology

  22. SGX Limitations www.tugraz.at Classical Prime+Probe cannot be mounted within SGX: • No access to high-precision timer ( rdtsc ) • No syscalls 10 Daniel Gruss, Michael Schwarz — Graz University of Technology

  23. SGX Limitations www.tugraz.at Classical Prime+Probe cannot be mounted within SGX: • No access to high-precision timer ( rdtsc ) • No syscalls • No shared memory 10 Daniel Gruss, Michael Schwarz — Graz University of Technology

  24. SGX Limitations www.tugraz.at Classical Prime+Probe cannot be mounted within SGX: • No access to high-precision timer ( rdtsc ) • No syscalls • No shared memory • No physical addresses 10 Daniel Gruss, Michael Schwarz — Graz University of Technology

  25. SGX Limitations www.tugraz.at Classical Prime+Probe cannot be mounted within SGX: • No access to high-precision timer ( rdtsc ) • No syscalls • No shared memory • No physical addresses • No 2 MB large pages 10 Daniel Gruss, Michael Schwarz — Graz University of Technology

  26. Timer www.tugraz.at • We have to build our own timer 11 Daniel Gruss, Michael Schwarz — Graz University of Technology

  27. Timer www.tugraz.at • We have to build our own timer • Timer resolution must be in the order of cycles 11 Daniel Gruss, Michael Schwarz — Graz University of Technology

  28. Timer www.tugraz.at • We have to build our own timer • Timer resolution must be in the order of cycles • Start a thread that continuously increments a global variable 11 Daniel Gruss, Michael Schwarz — Graz University of Technology

  29. Timer www.tugraz.at • We have to build our own timer • Timer resolution must be in the order of cycles • Start a thread that continuously increments a global variable • The global variable is our timestamp 11 Daniel Gruss, Michael Schwarz — Graz University of Technology

  30. Timer www.tugraz.at • We have to build our own timer • Timer resolution must be in the order of cycles • Start a thread that continuously increments a global variable • The global variable is our timestamp • This is even 15 % faster than the native timestamp counter 1 mov &timestamp , % rcx 2 1: i n c % rax 3 mov % rax , (% rcx ) 4 jmp 1b 11 Daniel Gruss, Michael Schwarz — Graz University of Technology

  31. Physical Addresses www.tugraz.at • Cache set is determined by part of physical address [Mau+15] 12 Daniel Gruss, Michael Schwarz — Graz University of Technology

  32. Physical Addresses www.tugraz.at • Cache set is determined by part of physical address [Mau+15] • We have no knowledge of physical addresses 12 Daniel Gruss, Michael Schwarz — Graz University of Technology

  33. Physical Addresses www.tugraz.at • Cache set is determined by part of physical address [Mau+15] • We have no knowledge of physical addresses • Use the reverse-engineered DRAM mapping [Pes+16] 12 Daniel Gruss, Michael Schwarz — Graz University of Technology

  34. Physical Addresses www.tugraz.at • Cache set is determined by part of physical address [Mau+15] • We have no knowledge of physical addresses • Use the reverse-engineered DRAM mapping [Pes+16] • Exploit timing differences to find DRAM row borders 12 Daniel Gruss, Michael Schwarz — Graz University of Technology

  35. Physical Addresses www.tugraz.at • Cache set is determined by part of physical address [Mau+15] • We have no knowledge of physical addresses • Use the reverse-engineered DRAM mapping [Pes+16] • Exploit timing differences to find DRAM row borders • The 18 LSBs are ‘0’ at a row border 12 Daniel Gruss, Michael Schwarz — Graz University of Technology

  36. Physical Addresses www.tugraz.at 0 127 8 kB row x in BG0 (1) and channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 8 kB row x in BG0 (0) and channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 8 kB row x in BG0 (1) and channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 8 kB row x in BG0 (0) and channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 4 kB Page #1 4095 13 Daniel Gruss, Michael Schwarz — Graz University of Technology

  37. Physical Addresses www.tugraz.at 0 127 BG0 (0), Channel (0) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) 8 kB row x in BG0 (0) and channel (1) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) 8 kB row x in BG0 (0) and channel (0) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) 4 kB Page #1 4095 13 Daniel Gruss, Michael Schwarz — Graz University of Technology

  38. Physical Addresses www.tugraz.at 0 127 BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (1) BG0 (1), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) BG0 (1), Channel (0) 8 kB row x in BG0 (0) and channel (1) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (0) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (0) BG0 (1), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) BG0 (1), Channel (0) 8 kB row x in BG0 (0) and channel (0) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (0) BG0 (0), Channel (0) BG0 (1), Channel (0) 4 kB Page #1 4095 13 Daniel Gruss, Michael Schwarz — Graz University of Technology

  39. Physical Addresses www.tugraz.at 0 127 BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (1) BG0 (1), Channel (0) BG0 (0), Channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) 8 kB row x in BG0 (0) and channel (1) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) 8 kB row x in BG0 (0) and channel (0) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) 4 kB Page #1 4095 13 Daniel Gruss, Michael Schwarz — Graz University of Technology

  40. Physical Addresses www.tugraz.at 0 127 BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (1), Channel (1) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (1) BG0 (1), Channel (0) BG0 (0), Channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (1) BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) 8 kB row x in BG0 (0) and channel (1) BG0 (1), Channel (1) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (1), Channel (1) BG0 (0), Channel (0) 8 kB row x in BG0 (1) and channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (1) BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) 8 kB row x in BG0 (0) and channel (0) BG0 (1), Channel (1) BG0 (0), Channel (0) Page #1 Page #2 Page #3 Page #4 Page #5 Page #6 Page #7 Page #8 BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (1), Channel (1) BG0 (0), Channel (0) BG0 (1), Channel (0) BG0 (0), Channel (1) BG0 (1), Channel (1) 4 kB Page #1 4095 13 Daniel Gruss, Michael Schwarz — Graz University of Technology

  41. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  42. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  43. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  44. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  45. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  46. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  47. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  48. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  49. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  50. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  51. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  52. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

  53. Physical Addresses www.tugraz.at row n row n + 1 row n + 2 row n + 3 row n + 4 row n + 5 14 Daniel Gruss, Michael Schwarz — Graz University of Technology

Recommend


More recommend