SoK: The Challenges, Pitfalls, and Perils of Using Hardware - - PowerPoint PPT Presentation

▶
sok the challenges pitfalls and perils of using hardware
SMART_READER_LITE
LIVE PREVIEW

SoK: The Challenges, Pitfalls, and Perils of Using Hardware - - PowerPoint PPT Presentation

Nov 06, 2022 242 likes •530 views

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security Sanjeev Das , Jan Werner, Manos Antonakakis, Michalis Polychronakis, and Fabian Monrose SoK: The Challenges, Pitfalls, and Perils of Using Hardware

slide-1
SLIDE 1

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security

Sanjeev Das,

Jan Werner, Manos Antonakakis, Michalis Polychronakis, and Fabian Monrose

slide-2
SLIDE 2

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

2

Hardware Performance Counters

slide-3
SLIDE 3

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

3

  • Available in processors for over two decades
  • Monitor and measure hardware events, e.g.:
  • Instruction retired, cycles
  • Memory accesses
  • Cache hits/misses
  • Translation look-aside buffer hits/misses
slide-4
SLIDE 4

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

4

  • Myriad of applications:
  • Software Profiling
  • Debugging
  • High Performance Computing
  • Power Analysis
  • Sharp rise in security domain
slide-5
SLIDE 5

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

5

  • HPCs provide a good foundation for measuring micro-

architectural information (e.g., branch misses, cache misses)

  • Low performance overhead
slide-6
SLIDE 6

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

6

Recent Security Applications

On the feasibility of online malware detection with performance counters. Demme et al., SIGARCH, 2013. SIGDROP: Signature-based ROP Detection using Hardware Performance

  • Counters. Wang et al. [arXiv’16]

Hardware-Assisted Rootkits: Abusing Performance Counters on the ARM and x86

  • Architectures. Spisak et al. [WOOT’16]

Who Watches the Watchmen?: Utilizing Performance Monitors for Compromising Keys of RSA on Intel Platforms, Bhattacharya et al.[CHES’15]

slide-7
SLIDE 7

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Detecting Spectre And Meltdown Using Hardware Performance

  • Counters. Pierce, Endgame Inc., Jan. 08, 2018

Detecting Attacks that Exploit Meltdown and Spectre with Performance Counters. Fiser & Gamazo Sanchez, Trend Micro Inc., 2018 Detecting Spectre Attacks by identifying Cache Side-Channel Attacks using Machine Learning. Depoix et al. [WAMOS, 2018]

7

Recent Security Applications

slide-8
SLIDE 8

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

8

Impetus of this SoK paper: Can we use HPCs as a foundation for thwarting Data Only Attacks?

slide-9
SLIDE 9

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

9

  • Which events should we measure?
  • There are HUNDREDS of HPC events
  • How are the events related to each other?
  • Is there a standard way to collect HPC

measurements?

  • What framework should we use?
  • Collection techniques vary widely

Challenges

slide-10
SLIDE 10

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

10

  • Non-determinism issue in HPCs
  • “Can hardware performance counters be

trusted?” Weaver & McKee, Workload Characterization, 2008

  • Lack of application-level profiling
  • No process-level filtering of HPC data at the hardware level
slide-11
SLIDE 11

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

11

Did other researchers also notice these pitfalls?

slide-12
SLIDE 12

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

12

  • We analyzed nearly 100 papers from

different application domains

  • We also conducted a survey:
  • Sent questionnaire to authors
  • After repeated attempts, response was 28%
  • Debugging
  • Power Analysis
  • Performance Analysis
  • Security
slide-13
SLIDE 13

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Findings

  • We examined 56 papers that acknowledged

non-determinism issues from non-security application domains

  • Painstakingly evaluated if they recommended

using HPCs

  • 45% of the papers did not, because of lack
  • f determinism and portability

13

45% 55%

Non-security domains

Yes No

slide-14
SLIDE 14

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Findings

14

  • Of the 40 security papers that used HPCs
  • Only 10% acknowledge non-

determinism issues

  • Acceptance of HPCs in security is in

stark contrast to other domains

Can hardware performance counters be trusted? Weaver & McKee, Workload Characterization, 2008

slide-15
SLIDE 15

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

15

Common Failures

  • Mishandling of performance counter data
  • Lack of process-level filtering
  • Ignoring non-determinism issues
  • Skid
  • Over/under-counting of events
slide-16
SLIDE 16

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

16

Handling of HPC Data

  • Limited number of programmable counters
  • Configuration
  • done in kernel mode by reading and writing into

model specific registers (MSRs)

  • Two modes : Polling vs Sampling
slide-17
SLIDE 17

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

17

Handling of HPC Data

  • 2. Program begin execution
  • 3. PMI is generated
  • 4. At interrupt, read counter values

1.Configure events in sampling mode, e.g., N instructions retired

N instructions

Event-based sampling using Performance Monitoring Interrupt (PMI)

slide-18
SLIDE 18

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Mishandling of HPC Data

18

PMI PMI Context switch Context switch Process A Process A Save HPC Restore HPC Noise from process B Process B Loss of events’ count

Filtering of processes at performance monitoring interrupt (PMI)

Fix :

  • Thankfully, there is an easy fix
  • Some papers applied this fix, but many didn’t
slide-19
SLIDE 19

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Non-determinism: Skid

  • In sampling mode:
  • Late delivery of PMI (due to skid)

leads to variation in measurements

  • Fingerprint of an application may

disappear (e.g., Data only attacks)

19

N 2N 3N Program execution E.g., sampling every N DTLB misses PMI skid skid PMI N+10 N+30

“Hardware performance monitoring for the rest of us: a position and survey” Moseley et al., Network and Parallel Computing, 2011

slide-20
SLIDE 20

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

20

  • We revisited the non-determinism

issues based on the seminal work by Weaver & McKee [IWC, 2008]

  • Several problems fixed, but some old

issues persist even today

  • New problem: page faults

Non-determinism: Overcount

slide-21
SLIDE 21

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

21

Why do these issues matter from a security perspective?

slide-22
SLIDE 22

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

22

  • Improper use of HPC in security applications can be disastrous
  • Incorrect data collection can impact the correctness of an approach
  • An adversary can manipulate events (e.g., via page faults) to undermine defenses
slide-23
SLIDE 23

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

23

Malware (14 families), Benign app (IE)

  • Approach
  • State of the art temporal model by Tang et al. [RAID’14]
  • Sampling using PMI every N instructions retired
  • Events — store micro-operations, indirect call,

mispredicted return and return instructions

Case Study: Malware Classification

slide-24
SLIDE 24

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Results

24

Filtering process at PMI Saving HPCs at Context switches

  • Incorrect HPC data collection significantly impacts detection accuracy
  • Larger question: are HPCs a good foundation for malware detection?
  • “Hardware Performance Counters Can Detect Malware: Myth or

Fact?” [Zhou et al., AsiaCCS, 2018]

slide-25
SLIDE 25

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

25

INC EAX; RET POP EBP; RET INC EDX; INC ECX; RET INC EDX; INC ECX; RET POP EDI; POP EBP; RET

ROP Attack!

Ret.

Instruction = 0 Return = 0 Instruction = 2 Instruction = 4 Instruction = 7 Instruction = 10 Instruction = 13 Instruction = 16 Return = 1 Return = 2 Return = 3 Return = 4 Return = 5 Return = 6

=

POP ESI; POP EDI; RET

Ins.

Gadgets

  • Approach
  • State of the art [Wang & Backer, arXiv, 2016]
  • For a given number of return misses, and number of instructions retired

< = threshold

Case Study: ROP Detection

slide-26
SLIDE 26

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

26

Case Study: ROP Detection Results

Init. Gadget

INC EAX; RET

Manipulator Gadget Manipulator Gadget

POP EBP; RET

Ret.

Instruction = 0 Return = 0 Instruction = 2 Instruction = 4 Instruction = 257 Instruction = 260 Instruction = 513 Instruction = 516 Return = 1 Return = 2 Return = 3 Return = 4 Return = 5 Return = 6

INC EDX; INC ECX; RET

Ins.

Gadgets No ROP detected!

=

  • Irrespective of parameter choices, non-determinism can be

leveraged by an adversary to bypass the ROP detection

slide-27
SLIDE 27

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

27

  • We need make sure we are not blindly

applying HPCs to security applications, especially defenses, in ways that go beyond their original intent

  • See our recommendations on using HPCs

HPCs offer a powerful capability, but like anything else, the devil is in the details

Closing remarks

slide-28
SLIDE 28

SoK: The Challenges, Pitfalls, and Perils of Using Hardware Performance Counters for Security, S&P’19

Questions?

28

sdas@cs.unc.edu