Exploiting Out-of-Order-Execution Processor Side Channels to Enable - - PowerPoint PPT Presentation

▶
exploiting out of order execution
SMART_READER_LITE
LIVE PREVIEW

Exploiting Out-of-Order-Execution Processor Side Channels to Enable - - PowerPoint PPT Presentation

Aug 24, 2023 31 likes •494 views

Exploiting Out-of-Order-Execution Processor Side Channels to Enable Cross VM Code Execution Sophia DAntoine REcon 2015 The Cloud 06/19/2015 Exploiting Out-of-Order-Execution 2/46 Cloud Computing (IaaS) Virtual instances Hypervisors

slide-1
SLIDE 1

Exploiting Out-of-Order-Execution

Processor Side Channels to Enable Cross VM Code Execution

Sophia D’Antoine

REcon 2015

slide-2
SLIDE 2

The Cloud

06/19/2015 Exploiting Out-of-Order-Execution 2/46

slide-3
SLIDE 3

Cloud Computing (IaaS)

  • Virtual instances
  • Hypervisors

Dynamic allocation => Reduces cost

06/19/2015 Exploiting Out-of-Order-Execution 3/46

slide-4
SLIDE 4

Everyone’s Happy

06/19/2015 Exploiting Out-of-Order-Execution 4/46

slide-5
SLIDE 5

Problems with the Cloud

Security issues with cloud computing

06/19/2015 Exploiting Out-of-Order-Execution 5/46

  • Vulnerable host
  • Untrusted host
  • Sensitive data

stored remotely

  • Co-located with

foreign VM’s

slide-6
SLIDE 6

Physical co-location leads to side channel vulnerabilities.

wat

06/19/2015 Exploiting Out-of-Order-Execution 6/46

slide-7
SLIDE 7

Cloud Hardware

06/19/2015 Exploiting Out-of-Order-Execution 7/46

slide-8
SLIDE 8

Universal Vulnerabilities

1) Translation between physical and virtual hardware based on need

06/19/2015 Exploiting Out-of-Order-Execution 8/46

2) Allocation causes contention 3) Private VM activities not opaque to aaco-residents

slide-9
SLIDE 9

Overview

  • 1. Introduction
  • 2. Cloud exploitation techniques
  • 3. Targeting the processor
  • 4. Importance of memory models
  • 5. Design of an Out-of-Order-Execution

channel

  • 6. Demo
  • 7. Conclusion

06/19/2015 Exploiting Out-of-Order-Execution 9/46

slide-10
SLIDE 10

Side Channel Attack

“In cryptography, a side- channel attack is any attack based on information gained from the physical implementation of a cryptosystem”

06/19/2015 Exploiting Out-of-Order-Execution 10/46

Cloud Computing

  • Hardware side

channel

  • Cross virtual

machine

  • Information gained

through recordable changes in the system

slide-11
SLIDE 11
  • Hardware agnostic
  • Two methods of interacting

– Transmit – Receive

Classification S/R Model

transmit: force artifacts receive: record artifacts

Hardware

06/19/2015 Exploiting Out-of-Order-Execution 11/46

slide-12
SLIDE 12
  • Transmit & Receive (network)
  • 1. communication (C&C)
  • Receive (exfiltrate)
  • 1. crypto key theft
  • 2. process monitoring
  • 3. environment keying
  • 4. broadcast signal

Possible Exploits

  • Transmit (infiltrate)
  • 1. DoS
  • 2. co-residency

06/19/2015 Exploiting Out-of-Order-Execution 12/46

slide-13
SLIDE 13

Communication

Communication Medium

VM1 R S R S VM2 Client Master VM S R

Virtual Allocations Shared Hardware

06/19/2015 Exploiting Out-of-Order-Execution 13/46

slide-14
SLIDE 14

Cache Side Channel Example [3]

Flush+Reload targets the L3 Cache Tier

  • Receiving Mechanism (Adversary)

– Flushes & queries

  • Transmitting Mechanism (Victim)

– Accesses same L3 line

  • Leaked GnuPG Private Key

sophia.re/cache.pdf

06/19/2015 Exploiting Out-of-Order-Execution 14/46

slide-15
SLIDE 15

Pipeline vs Cache Channel

Benefits:

  • Quiet, covert channel
  • Not affected by cache misses, etc.
  • Channel & noise amplifies in a crowded cloud

environment

06/19/2015 Exploiting Out-of-Order-Execution 15/46

slide-16
SLIDE 16

Overview

  • 1. Introduction
  • 2. Cloud exploitation techniques
  • 3. Targeting the pipeline
  • 4. Importance of memory models
  • 5. Design of an Out-of-Order-Execution

channel

  • 6. Demo
  • 7. Conclusion

06/19/2015 Exploiting Out-of-Order-Execution 16/46

slide-17
SLIDE 17

The Attack Vector

Side Channels which Exploit Hardware Vulnerabilities Inherent to Modern Cloud Computing Systems

06/19/2015 Exploiting Out-of-Order-Execution 17/46

Requirements:

  • Shared hardware
  • Dynamically allocated hardware resources
  • Co-Location with adversarial VMs or infected VMs
slide-18
SLIDE 18

Pipeline Side Channel

We chose to target the processor as the hardware medium. => CPU’s pipeline => System artifacts queried dynamically

06/19/2015 Exploiting Out-of-Order-Execution 18/46

  • Instruction order
  • Results from instruction sets
slide-19
SLIDE 19

Out-of-Order-Execution

Exploiting Out-of-Order-Execution 19/46 06/19/2015

slide-20
SLIDE 20

Processor Pipeline Contention

06/19/2015 Exploiting Out-of-Order-Execution 20/46

Process01 Process02 Process03 Process04

VM VM VM VM Processor Core01 Core02

SMT Optimizes Shared Hardware Pipeline Executing Instructions From Foreign Applications

slide-21
SLIDE 21

RECEIVER

Exploiting Out-of-Order-Execution 21/46 06/19/2015

slide-22
SLIDE 22

Record Out of Order Execution [6]

06/19/2015 Exploiting Out-of-Order-Execution 22/46

slide-23
SLIDE 23

Record Out of Order Execution

06/19/2015 Exploiting Out-of-Order-Execution 23/46

store [X], 1 load r1, [Y] store [Y], 1 load r2, [X]

THREAD 1 THREAD 2

Synched

=>

r1 = r2 = 1

store [X], 1 load r1, [Y] store [Y], 1 load r2, [X]

Asynched

=>

r1 = 0 r2 = 1

load r1, [Y] store [X], 1 load r2, [X] store [Y], 1

Out of Order Execution

=>

r1 = r2 = 0

slide-24
SLIDE 24

Record Out of Order Execution

06/19/2015 Exploiting Out-of-Order-Execution 24/46

int X,Y,count_OoOE; ….initialize semaphores Sema1 & Sema2… pthread_t thread1, thread2; pthread_create(&threadN, NULL, threadNFunc, NULL); for (int iterations = 1; ; iterations++) X,Y = 0; sem_post(beginSema1 & beginSema2); sem_wait(endSema1 & endSema2); if (r1 == 0 && r2 == 0) count_OoOE ++;

Averages matter

slide-25
SLIDE 25

TRANSMITTER

Exploiting Out-of-Order-Execution 25/46 06/19/2015

slide-26
SLIDE 26

Force Out of Order Execution

06/19/2015 Exploiting Out-of-Order-Execution 26/46

Mfence:

  • x86 instruction full memory barrier

prevents memory reordering of any kind

  • order of 100 cycles per operation
  • … mov dword ptr [_spin1], 0

… mfence … mov dword ptr [_spin2], 0 … mfence

slide-27
SLIDE 27

Force Out of Order Execution

Exploiting Out-of-Order-Execution 27/46

THE PIPELINE Store [X], 1

mfence

….. …..

Load r1, [X] NOP NOP

slide-28
SLIDE 28

Overview

  • 1. Introduction
  • 2. Cloud exploitation techniques
  • 3. Targeting the processor
  • 4. Importance of memory models
  • 5. Design of an Out-of-Order-Execution

channel

  • 6. Demo
  • 7. Conclusion

06/19/2015 Exploiting Out-of-Order-Execution 28/46

slide-29
SLIDE 29

Categorize Out of Order Execution

Memory Reordering

Compilation Time Processor (Run) Time GCC Multithreaded Programs OoOE Execution MultiCored (MultiExecution Processors) Computers

Types of Memory Reordering

06/19/2015 Exploiting Out-of-Order-Execution 29/46

slide-30
SLIDE 30

Categorize Out of Order Execution Processor (Run) Time OoOE Execution MultiCored (MultiExecution Processors) Computers

Types of Memory Reordering

Dynamic side channel artifacts

06/19/2015 Exploiting Out-of-Order-Execution 30/46

slide-31
SLIDE 31

[7]

06/19/2015 Exploiting Out-of-Order-Execution 31/46

slide-32
SLIDE 32

Categorize Out of Order Execution

Types of Memory Reordering

  • Instruction A visible to all processes before B occurs
  • #StoreLoad most expensive operation

[4, 5]

06/19/2015 Exploiting Out-of-Order-Execution 32/46

slide-33
SLIDE 33

Force Out of Order Execution

Memory Barrier

  • ‘Lock-free programming’ on SMT

multiprocessors

  • #StoreLoad unique prevents r1=r2=0
  • x86: mfence ( effects the pipeline )

06/19/2015 Exploiting Out-of-Order-Execution 33/46

slide-34
SLIDE 34
  • Out-of-Order-Execution
  • 06/19/2015

Exploiting Out-of-Order-Execution 34/46

slide-35
SLIDE 35

Overview

  • 1. Introduction
  • 2. Cloud exploitation techniques
  • 3. Targeting the processor
  • 4. Importance of memory models
  • 5. Design of an Out of Order Execution channel
  • 6. Demo
  • 7. Conclusion

06/19/2015 Exploiting Out-of-Order-Execution 35/46

slide-36
SLIDE 36

Lab Model

Scheduler Xen hypervisor

  • Popular commercial IaaS platforms

Xeon Processors Shared multi-core/ multi-processor hardware

  • 8 logical CPU’s/ 4 cores
  • 6 virtual machines (VM’s)
  • Parallel Processing/ Simultaneous Multi-Threading

On (SMT)

06/19/2015 Exploiting Out-of-Order-Execution 36/46

slide-37
SLIDE 37
  • 6 Windows 7 VM’s

Virtual Machines

VM1 VM2 VM3 VM4 VM5 VM6 CPU1 P1 P2 P3 P4 CPU1

06/19/2015 Exploiting Out-of-Order-Execution 37/46

slide-38
SLIDE 38

Virtual Machine S/R

06/19/2015 Exploiting Out-of-Order-Execution 38/46

slide-39
SLIDE 39

Overview

  • 1. Introduction
  • 2. Cloud exploitation techniques
  • 3. Targeting the processor
  • 4. Importance of memory models
  • 5. Design of an Out-of-Order-Execution

channel

  • 6. Demo
  • 7. Conclusion

06/19/2015 Exploiting Out-of-Order-Execution 39/46

slide-40
SLIDE 40

Demo Links

06/19/2015 Exploiting Out-of-Order-Execution 40/46

sophia.re/sender.py sophia.re/receiver.py

slide-41
SLIDE 41

Overview

  • 1. Introduction
  • 2. Cloud exploitation techniques
  • 3. Targeting the processor
  • 4. Importance of memory models
  • 5. Design of an Out-of-Order-Execution channel
  • 6. Demo
  • 7. Conclusion

06/19/2015 Exploiting Out-of-Order-Execution 41/46

slide-42
SLIDE 42

Potential Channel Mitigation

Protected Resource Ownership

  • Isolating VM’s
  • Turn off hyperthreading
  • Blacklisting resources for concurrent threads
  • Downside: cloud benefits

06/19/2015 Exploiting Out-of-Order-Execution 42/46

slide-43
SLIDE 43

In Conclusion...

Contribution:

We demonstrate a novel Out of Order Execution side channel.

  • Dynamic querying/ forcing method
  • Application to cloud computing
  • Mitigation techniques

06/19/2015 Exploiting Out-of-Order-Execution 43/46

slide-44
SLIDE 44

Acknowledgements

  • Jeremy Blackthorne
  • RPISEC
  • Trail of Bits

06/19/2015 Exploiting Out-of-Order-Execution 44/46

slide-45
SLIDE 45

Any Questions?

IRC: quend (#rpisec, #pwning) email: sophia@trailofbits.com thesis link: sophia.re/thesis.pdf

06/19/2015 Exploiting Out-of-Order-Execution 45/46

slide-46
SLIDE 46

References

[1] http://www.thewhir.com/web-hosting-news/aws-to-reach-24-billion-in-revenue-by-2022-morgan-stanley [2] http://www.forbes.com/sites/louiscolumbus/2015/01/24/roundup-of-cloud-computing-forecasts-and-market- estimates-2015/ [3] https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-yarom.pdf [4] http://bartoszmilewski.com/2008/11/05/who-ordered-memory-fences-on-an-x86/ [5] http://preshing.com/20120913/acquire-and-release-semantics/ [6] http://www.intel.com/Assets/en_US/PDF/manual/253668.pdf [7] http://preshing.com/20120930/weak-vs-strong-memory-models/ [8] http://en.wikipedia.org/wiki/Memory_barrier#An_illustrative_example [9] http://preshing.com/20120710/memory-barriers-are-like-source-control-operations/ 06/19/2015 Exploiting Out-of-Order-Execution 46/46