MicroScope: Enabling Microarchitectural Replay Attacks Dimitrios - - PowerPoint PPT Presentation

▶
microscope enabling microarchitectural replay attacks
SMART_READER_LITE
LIVE PREVIEW

MicroScope: Enabling Microarchitectural Replay Attacks Dimitrios - - PowerPoint PPT Presentation

Jun 15, 2023 529 likes •969 views

MicroScope: Enabling Microarchitectural Replay Attacks Dimitrios Skarlatos, Mengjia Yan, Bhargava Gopireddy, Read Sprabery, Josep Torrellas, and Christopher W. Fletcher Presented by Mengjia Yan MIT 6.888 Fall 2020 Why this paper? We have read

slide-1
SLIDE 1

MicroScope: Enabling Microarchitectural Replay Attacks

Dimitrios Skarlatos, Mengjia Yan, Bhargava Gopireddy, Read Sprabery, Josep Torrellas, and Christopher W. Fletcher Presented by Mengjia Yan MIT 6.888 Fall 2020

slide-2
SLIDE 2

Why this paper?

We have read a couple of attack papers, e.g., Spectre/Meltdown, Prime+Probe. Why read this paper? What is new here at a high level?

slide-3
SLIDE 3

Threat Model: Trusted Computing with SGX

  • OS/Hypervisor are untrusted
  • OS/Hypervisor cannot introspect/tamper enclave
  • Unfortunately, OS/Hypervisor still manages demand paging

Hardware Hypervisor Operating System App App App Attack Surface With Enclaves

Attack Surface Attacker (OS) can:

  • Manage page tables
  • Evict TLB entries
  • Evict page walk cache entries
  • Monitor side channels
slide-4
SLIDE 4

Recap: Address Translation

Virtual Address Space (Programmer's View) Physical Address Space (limited by DRAM size) 4KB 4KB VA PA Page Table per process System software handles “page fault” 4KB 4KB

4

slide-5
SLIDE 5

Background: Page Fault

  • Page fault: access to a page that is
  • Unmapped
  • Invalid
  • Wrong access rights
  • Exception is generated → Run page fault handler
  • Page fault handler = Operating system (untrusted)
slide-6
SLIDE 6

Controlled Side Channels

  • OS can monitor enclaves access pattern at the granularity of page
  • After enclave start, remove access from all process pages (mark page not

present)

  • Access will cause a page fault
  • Upon receiving a fault, the handler:
  • Logs the requested page
  • Enables access to the page
  • Removes access to the previous page

Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems; Xu et al. S&P’15

if (secret = 1) access page A else access page B

slide-7
SLIDE 7

Microscope Overview

slide-8
SLIDE 8

Motivation: Leakage over side channels

Attacker:

for .. t1 = time() use resource t2 = time()

Victim:

if (secret) use resource else don’t use resource

  • Need repeated measurements to be confident à Denoise
  • However, many applications run only once à Attacker gets 1 measurement
  • Can attackers really extract secrets?
slide-9
SLIDE 9

Overview: Microarchitectural Replay Attacks

  • Attacker leverages speculative execution
  • To repeatedly replay a snippet of victim code
  • That runs only once

ld addr // “replay handle” …

Victim:

ld secret // secret the attacker tries to leak Memory operation that will cause a squash and re-execute

}

Primitive to denoise arbitrary side channels

slide-10
SLIDE 10

Contribution: Microarchitectural Replay Attacks

Issue Replay Handle Long Latency Event Time ld addr:

slide-11
SLIDE 11

Contribution: Microarchitectural Replay Attacks

Issue Replay Handle Long Latency Event Speculative Execution of Secret ld secret: Time ld addr:

slide-12
SLIDE 12

Contribution: Microarchitectural Replay Attacks

Issue Replay Handle Long Latency Event Squash Event Squash Clear State Speculative Execution of Secret Time ld addr: ld secret:

slide-13
SLIDE 13

Contribution: Microarchitectural Replay Attacks

Issue Replay Handle Long Latency Event Squash Event Clear State

Replay!!

Cause Shared Resource Contention & Monitor Speculative Execution of Secret Squash ld addr: ld secret:

slide-14
SLIDE 14

Strengths

  • Opens large new attack surface (for noisy side channels)
  • Exploits vulnerabilities of correct speculation
  • Dynamic instructions can be replayed through controlled squashes
  • Different from Spectre/Meltdown that exploits incorrect speculation
  • Demonstrate attacks on notoriously noisy side channels
  • Make impractical attacks possible
slide-15
SLIDE 15

Weaknesses

  • Is it really practical?
  • Attacker side:
  • Malicious OS
  • Control TLB/page mapping
  • Victim side:
  • The replay handler and the transmitter need to be in the ROB simultaneously
  • The replay handler and the transmitter needs to access different pages
slide-16
SLIDE 16

Page Tables Background

pmd_t pte_t PGD PUD PMD PTE CR3

47 … 39 38 … 30 29 … 21 20 … 12 11 … 0 9-bits 9-bits 9-bits 9-bits Page Offset

+ + + + Virtual address Virtual Address TLB Entry pgd_t pud_t

  • Page tables stored in memory
  • On a TLB Miss à “page walk” = memory accesses
  • Each step of page walk = cache hit/miss.
  • Page walk cache (PWC): hardware cache of translations
  • If Present bit in pte_t is cleared à Page Fault, invoke OS
slide-17
SLIDE 17

Attack Examples

  • 1. //public address
  • 2. handle(pub_addr);
  • 3. ...
  • 4. transmit(secret);
  • 5. ...

Victim Code

  • 1. for i in ...

2. handle(pub_addrA); 3. ... 4. transmit(secret[i]); 5. ... 6. memOp(pub_addrB); 7. ...

Loop Victim Code:

slide-18
SLIDE 18

Terminology

  • 1. //public address
  • 2. handle(pub_addr);
  • 3. ...
  • 4. transmit(secret);
  • 5. ...

Victim Code Replay handle:

  • Load to a public address (known to OS)

Transmitter:

  • Any instruction(s) whose execution reveals secret through some side channel
  • Occurs < ROB length from Replay Handle
slide-19
SLIDE 19

Timeline of a MicroScope Attack - Setup

Attack Setup Victim Attacker Time

slide-20
SLIDE 20

Timeline of a MicroScope Attack - Setup

Attack Setup Clear PTE Present Bit of Replay Handle Victim Attacker Time

slide-21
SLIDE 21

Timeline of a MicroScope Attack - Setup

Attack Setup Flush Replay Handle Page Table Entries Victim Attacker Clear PTE Present Bit of Replay Handle Time

slide-22
SLIDE 22

Timeline of a MicroScope Attack - Setup

Attack Setup Flush Replay Handle TLB Entry Victim Attacker Flush Replay Handle Page Table Entries Clear PTE Present Bit of Replay Handle Time

slide-23
SLIDE 23

Timeline of a MicroScope Attack

Attacker Victim Attack Setup Issue Replay Handle Time

handle(pub_addr):

slide-24
SLIDE 24

Timeline of a MicroScope Attack

Attack Setup Issue Replay Handle L1 TLB Miss Victim Attacker Time

handle(pub_addr):

slide-25
SLIDE 25

Timeline of a MicroScope Attack

Attack Setup Issue Replay Handle L1 TLB Miss Speculative Execution

  • f Transmitter

Victim Attacker L2 TLB Miss Time

handle(pub_addr): transmit(secret):

slide-26
SLIDE 26

Timeline of a MicroScope Attack

Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss Speculative Execution of Transmitter Victim Attacker Time

handle(pub_addr): transmit(secret):

slide-27
SLIDE 27

Timeline of a MicroScope Attack

Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Victim Attacker Time

handle(pub_addr): transmit(secret):

slide-28
SLIDE 28

Timeline of a MicroScope Attack

Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Victim Attacker Tune speculative execution duration with: Cache Hit or Miss Speculative Execution of Transmitter Time

handle(pub_addr): transmit(secret):

slide-29
SLIDE 29

Timeline of a MicroScope Attack

Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Page Fault Victim Attacker Time

handle(pub_addr): transmit(secret):

slide-30
SLIDE 30

Timeline of a MicroScope Attack

Squash Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Page Fault Victim Attacker Time

handle(pub_addr): transmit(secret):

slide-31
SLIDE 31

Timeline of a MicroScope Attack

Squash OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Time Page Fault Victim Attacker

handle(pub_addr): transmit(secret):

slide-32
SLIDE 32

Timeline of a MicroScope Attack

Squash OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Page Fault Victim Attacker Page Fault Handler

handle(pub_addr): transmit(secret):

slide-33
SLIDE 33

Timeline of a MicroScope Attack

Squash OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Page Fault Victim Attacker Flush Replay Handle Page Table Entries

handle(pub_addr): transmit(secret):

Page Fault Handler

slide-34
SLIDE 34

Timeline of a MicroScope Attack

Squash OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Page Fault Victim Attacker Replay!!

handle(pub_addr): transmit(secret):

slide-35
SLIDE 35

Timeline of a MicroScope Attack

OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Squash Speculative Execution of Transmitter Page Fault Victim Attacker

handle(pub_addr): transmit(secret):

slide-36
SLIDE 36

Timeline of a MicroScope Attack

OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Squash Speculative Execution of Transmitter Page Fault Victim Attacker

handle(pub_addr): transmit(secret):

slide-37
SLIDE 37

Timeline of a MicroScope Attack

Victim Attacker Monitor/Contention thread Cause Shared Resource Contention & Monitor Replay!! Squash OS Invocation Attack Setup Issue Replay Handle L1 TLB Miss L2 TLB Miss PWC Miss PGD Walk PUD Walk PMD Walk PTE Walk Speculative Execution of Transmitter Page Fault Attacker

handle(pub_addr): transmit(secret):

slide-38
SLIDE 38

Changing each can result in different attacks!!

Strategy Measure Secret Attacker Replay Handle Window Victim Replayed Code Trigger Replay? Side Channels? 1 2 3 4

Generalize Microarchitectural Replay Attacks

à Page fault-inducing load à Leaky instruction à uarch structures à Page fault until denoise

1 2 3

4

This work: Replay Handle Replayed Code Side Channel Attacker strategy

slide-39
SLIDE 39

Countermeasures

  • Fence after pipeline squash
  • Defenses against Spectre/Meltdown style of attacks
  • Rewrite victim code to make replay handler and target code reside in

the same page

  • etc
slide-40
SLIDE 40

Discussion Questions

slide-41
SLIDE 41

Discussion Questions on Countermeasures

  • What is required to prevent this in hardware? Would a form of page fault counter be appropriate,

where if a specific instruction page faulted some number of times in a row, the application terminates? Or is this a common scenario in a real process, that a single page may fault repeatedly?

  • Would something like FaCT for the SGX application help prevent a significant subset of the

available side channels? Or really any other way to make sure that the instruction trace is always constant...

  • Are the weaknesses of SGX things that can be patched over as new attacks are demonstrated or is

there a more fundamental problem with an untrusted OS? More out of curiosity, but are there adversaries out there trying to exploit these kinds of vulnerabilities right now, and if so how and in what context?

slide-42
SLIDE 42

Discussion Questions on Countermeasures

  • When referring to page fault protection schemes, why can’t we control how the present bit is set?

A key component of this attack is the attacker’s ability to clear the Present bit so would it not be possible to focus on this aspect?

  • The paper mentioned that T-SGX terminates the program after N=10 consecutive failed page

faults as a potential defense to this type of attack. Was 10 chosen arbitrarily? How did they guarantee that this wouldn't interfere with existing programs? If they set it to a smaller number in

  • rder to prevent replay attacks, how would they ensure it would continue to let existing programs

work?

  • How difficult is it to manipulate where replay handles occur? Can user code force secrets to be

contained within a single page? Can user code avoid speculatively affecting side channels by adding data dependency across pages?