ARMageddon: Last-Level Cache Attacks on Mobile Devices

Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clémentine Maurice, Stefan Mangard

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Abstract

In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices.
Original languageEnglish
Title of host publication25th USENIX Security Symposium (USENIX Security 16)
PublisherUSENIX Association
Pages549-564
Number of pages16
Publication statusPublished - 2016

Fingerprint

Mobile devices
Program processors
Smartphones
Touch screens

Cite this

Lipp, M., Gruss, D., Spreitzer, R., Maurice, C., & Mangard, S. (2016). ARMageddon: Last-Level Cache Attacks on Mobile Devices. In 25th USENIX Security Symposium (USENIX Security 16) (pp. 549-564). USENIX Association.

ARMageddon: Last-Level Cache Attacks on Mobile Devices. / Lipp, Moritz; Gruss, Daniel; Spreitzer, Raphael; Maurice, Clémentine; Mangard, Stefan.

25th USENIX Security Symposium (USENIX Security 16). USENIX Association, 2016. p. 549-564.

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Lipp, M, Gruss, D, Spreitzer, R, Maurice, C & Mangard, S 2016, ARMageddon: Last-Level Cache Attacks on Mobile Devices. in 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, pp. 549-564.
Lipp M, Gruss D, Spreitzer R, Maurice C, Mangard S. ARMageddon: Last-Level Cache Attacks on Mobile Devices. In 25th USENIX Security Symposium (USENIX Security 16). USENIX Association. 2016. p. 549-564
Lipp, Moritz ; Gruss, Daniel ; Spreitzer, Raphael ; Maurice, Clémentine ; Mangard, Stefan. / ARMageddon: Last-Level Cache Attacks on Mobile Devices. 25th USENIX Security Symposium (USENIX Security 16). USENIX Association, 2016. pp. 549-564
@inproceedings{1c8d5424dee14fbdac421230ddf8ab9f,
title = "ARMageddon: Last-Level Cache Attacks on Mobile Devices",
abstract = "In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices.",
author = "Moritz Lipp and Daniel Gruss and Raphael Spreitzer and Cl{\'e}mentine Maurice and Stefan Mangard",
year = "2016",
language = "English",
pages = "549--564",
booktitle = "25th USENIX Security Symposium (USENIX Security 16)",
publisher = "USENIX Association",
address = "United States",

}

TY - GEN

T1 - ARMageddon: Last-Level Cache Attacks on Mobile Devices

AU - Lipp, Moritz

AU - Gruss, Daniel

AU - Spreitzer, Raphael

AU - Maurice, Clémentine

AU - Mangard, Stefan

PY - 2016

Y1 - 2016

N2 - In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices.

AB - In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices.

M3 - Conference contribution

SP - 549

EP - 564

BT - 25th USENIX Security Symposium (USENIX Security 16)

PB - USENIX Association

ER -