Hardware Security / Side Channel Attacks

Question 1

Hardware Security - Definitions 2 types of definitions:

Answer 1

• 1) Implementing security protection mechanisms in hardware rather than software
• 2) Protecting hardware itself

Question 2

• 1) Implementing security protection mechanisms in hardware rather than software: e.g.?

Answer 2

• e.g., TEEs - A Trusted Execution Environment (TEE)
• e.g., PUFs - Physically Unclonable Functions (PUFs)

Question 3

• 2) Protecting hardware itself e.g.,

Answer 3

• e.g., bitstream security in FPGAs

Question 4

what is TEEs? Trusted Execution Environment

Answer 4

is a secure area of a main processor. It helps
code and data loaded inside it to be protected with respect to confidentiality and integrity.

Question 5

what os PUFs ? Physically Unclonable Functions

Answer 5

is (partly) disordered physical system which
operation cannot be reproduced even by its original manufacturer. It relies on the nanoscale
structural differences present in the device. For a given challenge, a PUF provides a physically
defined “digital fingerprint” response. The response serves as a unique identifier, often used to
construct keys for encryption.

Question 6

what is bitstreeam security in FPGAs?

Answer 6

A bitstream configures an FPGA and includes the description of the hardware logic, routing, and initial values for both registers and on-chip memory. Protecting it means making sure this configuration file is not replaced/altered/obtained by unauthorized parties. Bitstream security can be achieved by encrypting it using, e.g., PUFs (mentioned in the
last slide).

Question 7

Hardware Security – Why?

Answer 7

In relation to 1)
* Software: is (or can be) wildly vulnerable to attacks; “easy” to corrupt; widespread
knowledge on how it works, mutable, etc.
* Hardware: is, by nature, more secure than software; immutable (hence “hard”, not
“soft”) (ASIC), reconfigurable based on a configuration file (FPGAs).

In relation to 2)
* Attacks generally need: very comprehensive knowledge; and/or target very
specific/hard-to-find vulnerabilities; or require the use of side channels;
means to install hardware trojans; or require physical access; …

Question 8

Concepts:

Answer 8

CPU: executes instructions of a computer program, such as arithmetic, logic, controlling, and
input/output (I/O) operations.

Cache: hardware or software component that stores data so that future requests for that data can be served faster; the data stored in a cache might be the result of an earlier computation or a copy of data stored elsewhere. A cache hit occurs when the requested data can be found in a cache, while a cache miss occurs when it cannot.

Flush: what happens when the line for a given address is removed from every cache in a coherent system due to
a flush instruction (e.g., cflush)

Evict: Cache eviction is a feature where data blocks in the cache are released when usage exceeds a soft quota,
and space is created for new blocks. Can be forced manually, typically used when cflush is not available

Cache block: caches are divided into blocks. It’s the basic unit for cache storage. May contain multiple
bytes/words of data.

Memory page:fixed-length contiguous block of virtual memory, described by a single entry in a page
table. It is the smallest unit of data for memory management in an operating system that uses virtual
memory.

Question 9

what is Side channel attack?

Answer 9

is an exploit aiming to gather information from or influence the program execution of a system by measuring or exploiting indirect effects of the
system or its hardware, rather than targeting the program or its code directly.

Question 10

T/F Most commonly, these attacks aim to exfiltrate sensitive information, including
cryptographic keys, by measuring coincidental hardware emissions.

Answer 10

T

Question 11

example of side channel attack

Answer 11

Ciphertext —> Decryption process –> output(plaintext)
| ^
v |
-Cache attack |
-Timing attack ——> Side-channel analysis
-Power consumption monitoring
- Acoustic cryptanalysis
-Optical attack, etc…

Question 12

what is spectre attack?

Answer 12

use CPU cache as a side channel to steal a protected secret. The technique used in this side-channel attack is called FLUSH+RELOAD

Question 13

what is CPU cache?

Answer 13

is a hardware cache used by the CPU of a computer to reduce the average cost (time or energy) to access data from the main memory. Accessing data
from CPU cache is much faster.

Question 14

T/F When data is fetched from the main memory, it is usually cached by the CPU, so if
the same data is used again, the access time will be much faster. Therefore, when a
CPU needs to access some data, it first looks at its caches. If the data is there (hit), it
will be fetched directly from there. If the data is not there (miss), the CPU will go to
the main memory, which takes significantly longer.

Answer 14

T

Question 15

What is a side channel attack? – CPU context

Answer 15

• Attack which is enabled by the micro architectural design of the CPU and based on information gained from the implementation of a computer system.
• Types:
• Cache:attack which monitors how quickly data accesses take and infer whether or not said data was in the cache. We will focus on cache side-channels.
• Timing: attack which monitors time it takes for machine to do various computations
• Power-monitoring: attack which monitors power consumption of hardware on various computations…

Question 16

Cache side channel?

Answer 16

The side channel comes from monitoring how quickly data can be accessed from the
cache.

• Data which is accessed quickly => stored in the cache
• Data which is accessed slowly => stored in main memory

Question 17

Exploiting caching - Flush + Reload

Answer 17

• Flush any access of memory for data you control from the cache (e.g., with cflush())
• Let malicious/normal code run and access memory you control with a “secret” (i.e., some piece of
  data you don’t want disclosed – in the lab we will just use a simple value)
• Try reloading elements from the controlled memory and see how quickly they are accessed (see if
  they are in cache or in memory)

Question 18

Exploiting caching - Evict + Reload

Answer 18

• Evict memory access of data you control by loading other (possibly random) data into the cache
  (i.e., remove data from the cache by loading other data to force it out due to it being full)
• Due to the limited size of cache, the specific cache line is evicted
• Let the victim program run and access memory using the “secret”, reload data and measure access
  time

Question 19

Difference between Flush+Reload and Evict+Reload

Answer 19

*Flush+Reload uses a dedicated machine instruction, e.g., x86’sclflush, to evict the
cache lines.

*Evict+Reload forces contention (i.e., overload) on the cache set that stores the line,
causing the processor to discard the contents of that cache line. Evict+Reload
techniques are typically used when access toclflushis unavailable

Question 20

Flush+Reload – more detail

Answer 20

*The attack uses the timing differences between memory accesses from the cache and from the memory (DRAM)

*Suppose that your process runs the function foo() on core A, then A loads the instructions for foo() from main memory, executes them, and the instructions are
stored in the cache for later.

• If your process runs once again, the second execution will be faster than the first as A
  doesn’t need to load foo() from memory; it loads from the cache
• Now, let’s assume the attacker runs a process on core B, co-located in the same CPU. Since the last-level cache is shared between cores, the attacker can flush the stored
  function foo() in the cache by using clflush instruction—an instruction that can be invoked by any process.
• Then, the attacker calls the function foo() again. If the execution of foo() is fast, it means some other process ran the foo() before the attacker tried to reload it.
• Otherwise, it means no process ran foo() before the attacker. A Flush+Reload attacker repeats these steps periodically, monitoring a list of functions and identifies the sequence of function calls that the victim ran while processing an input

Question 21

Privilege check

Answer 21

• Modern CPUs enforce a privilege check of a program accessing kernel memory
• This privilege check sometimes occurs too late (i.e., once the data has already
  been read)
• Privilege checks aren’t performed until the instruction is completed
• The CPUs knows that this occurs, so anything unprivileged which was executed will be forgotten and an exception will be raised
• As a result, the memory that was accessed recently is still stored in cache

Question 22

What are Spectre and Meltdown?

Answer 22

• They are the nicknames for the three vulnerabilities:
• Variant 1: bounds check bypass (CVE-2017-5753)
• Variant 2: branch target injection (CVE-2017-5715)
• Variant 3: rogue data cache load (CVE-2017-5754)
• Variant 1 and 2 are Spectre
• Variant 3 is Meltdown

Question 23

What do they do?

Answer 23

Spectre:
*Breaks the isolation between different applications
*Allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets

Meltdown:
*Breaks the most fundamental isolation between user applications and the operating system

*Allows a program to access the memory, and thus also the secrets, of other programs and the operating system

Question 24

What do they affect?

Answer 24

*Affects some/all modern processors, servers, mobile phones (Apple SoCs)

*Meltdown
* Intel, ARM, IBM …
* Desktop, Laptop, and Cloud computers

*Spectre
* Intel, AMD, ARM, IBM …
* Desktops, Laptops, Cloud Servers, as well as Smartphones

*Affects all operating systems
* Linux, Windows, MacOS …

Question 25

What do they exploit?

Answer 25

*Exploit the three major designs in modern processors: *Out-of-order Execution *Speculative Execution *Caching *Both attacks use side channels to obtain information from the accessed memory location

Question 26

Out-of-order execution (OoO)

Answer 26

*Approach to processing that allows instructions to begin execution as soon as their operands are ready *Although instructions are issued in-order, they can proceed out-of-order with respect to each other *The goal is to allow the processor to avoid a class of stalls that occur when the data needed to perform an operation is unavailable

Question 27

Out-of-order execution - steps

Answer 27

1. Instruction fetch. 2. Instruction dispatch to an instruction queue 3. The instruction waits in the queue until its input operands are available. The instruction is then allowed to leave the queue before earlier, older instructions. 4. The instruction is issued to the appropriate functional unit and executed by that unit. 5. The results are queued. 6. Only after all older instructions have their results written back to the register file, then this result is written back to the register file. This is called the retire stage.

Question 28

Speculative execution

Answer 28

* It is a technique used by modern CPUs to speed up performance. The CPU may execute certain tasks ahead of time, "speculating" that they will be needed and complete them * If the tasks are required, a speed-up is achieved, because the work is already done * If the tasks are not required, changes made by the tasks are reverted and the results ignored

Question 29

OoO vs. Speculative - difference

Answer 29

* OoO execution is an execution model in which instructions can be dispatched to execution units in an order that is potentially different from the program order. However, the instructions are still retired in program order so that the program's observed behavior is the same as the one intuitively expected by the programmer. * Speculative execution is an execution model in which instructions can be fetched and enter the pipeline and begin execution without knowing for sure that they will indeed be required to execute (according to the control flow of the program).

Question 30

Spectre Attack – variant 1

Answer 30

if (x < array1_size) y = array2 [array1[x] * 4096]; * Exploiting Conditional Branch Misprediction * The code above is an example of conditional branch * x = (address of a secret byte to read) - (base address of array1) * This code looks normal and correct * If x is less than the length of array1, the conditional branch executes successfully * But let's assume that we have a variable here that stores the password at the address secret, * let A=secret-array1, so we can use array1[A] to represent the value of secret * Until x satisfies the conditional branch, above code block can be executed multiple times * the branch predictor think the next conditional branch will also satisfy the condition * If at this time we assigned the value A to x, the branch predictor will predict the conditional branch . for execution (actually should not execute) * the CPU will load the password secret value in cache and use it as the address to access Array2 * But eventually, the CPU will find this conditional branch should not be executed, so the value of Y should become invalid * Finally, the index array1[x] * 4096 of array2 holds the cached secret value

Question 31

Spectre Attack – variant 2 (Branch Target Buffer (BTB))

Answer 31

* The Branch Target Buffer (BTB) keeps a mapping from addresses of recently executed branch instructions to destination addresses * Processors can use the BTB to predict future code addresses even before decoding the branch instructions - Using Speculative Execution to improve the performance * Allows the CPU to speculatively execute code at predicted indirect branch target without actually having decoded the branch instructions * Attacker trains the Branch Target Buffer (BTB) to mispredict a branch from an indirect branch instruction to the address of the gadget. * Poisoning Indirect Branches * Indirect Branch: jumping to code at some memory location * e.g. jmp [eax] => jump to instruction stored at memory address in register EAX * Variant 2 is much like variant 1, but instead of abusing the data lookup portion of the CPU, it abuses the ability for a CPU to predict which way it will go when a function pointer is called. * The attacker needs to locate a “Spectre gadget”, i.e., a code fragment whose speculative execution will transfer the victim’s sensitive information into a covert channel * Attacker chooses a “Spectre gadget” from the victim’s address space * Trains the Branch Target Buffer (BTB) to mispredict a branch instruction to the address of the gadget * Resulting in speculative execution of this gadget - Not reliant on the vulnerability on victim’s code - Attacker has to find the virtual address of the gadget * Exploiting Branch Target Buffer (BTB) * As a result, the gadget code was run by speculative execution because of branch misprediction - The result will be loaded into the cache - A cache side-channel attack can be used to find the secret value

Question 32

Spectre - mitigation

Answer 32

* Spectre is harder to exploit than Meltdown, but it is also harder to mitigate * However, it is possible to prevent specific known exploits based on Spectre through software patches * Updating the OS and applications to the newest version, helps keeping Spectre away * Preventing Speculative Execution: - Ensure control flow leads the instruction - Software using serialization or speculation blocking - Causing a significant degradation in the performance * --> Without speculative execution, the attacker would not be able to get the code in the branch to be executed with an x that causes the access into array1 to reach the secret and cause the indexed element of array2 to be loaded in the cache. * Preventing Access to Secret Data - Chrome: one website per process * Preventing Branch Poisoning - Prevent indirect branch prediction to poison the CPU into speculatively executing into a memory location that it never would have otherwise executed * Limiting Data Extraction from Covert Channels * Preventing Data from Entering Covert Channels - Future processors (no such design is currently available)