Rapid Prototyping for Microarchitectural Attacks

Catherine Mary Easdon*, Michael Schwarz, Martin Schwarzl, Daniel Gruss

*Corresponding author for this work

Research output: Contribution to conferencePaperpeer-review

Abstract

In recent years, microarchitectural attacks have been demonstrated to be a powerful attack class. However, as our empirical analysis shows, there are numerous implementation challenges that hinder discovery and subsequent mitigation of these vulnerabilities. In this paper, we examine the attack development process, the features and usability of existing tools, and the real-world challenges faced by practitioners. We propose a novel approach to microarchitectural attack development, based on rapid prototyping, and present two open-source software frameworks, libtea and SCFirefox, that improve upon state-of-the-art tooling to facilitate rapid prototyping of attacks.

libtea demonstrates that native code attacks can be abstracted sufficiently to permit cross-platform implementations while retaining fine-grained control of microarchitectural behavior. We evaluate its effectiveness by developing proof-of-concept Foreshadow and LVI attacks. Our LVI prototype runs on x86-64 and ARMv8-A, and is the first public demonstration of LVI on ARM. SCFirefox is the first tool for browser-based microarchitectural attack development, providing the functionality of libtea in JavaScript. This functionality can then be used to iteratively port a prototype to unmodified browsers. We demonstrate this process by prototyping the first browser-based ZombieLoad attack and deriving a vanilla JavaScript and WebAssembly PoC running in an unmodified recent version of Firefox. We discuss how libtea and SCFirefox contribute to the security landscape by providing attack researchers and defenders with frameworks to prototype attacks and assess their feasibility.
Original languageEnglish
Publication statusAccepted/In press - 2021
Event31st USENIX Security Symposium: USENIX Security '22 - Boston, United States
Duration: 10 Aug 202212 Aug 2022
Conference number: 31

Conference

Conference31st USENIX Security Symposium
Abbreviated titleUSENIX '22
Country/TerritoryUnited States
CityBoston
Period10/08/2212/08/22

Fingerprint

Dive into the research topics of 'Rapid Prototyping for Microarchitectural Attacks'. Together they form a unique fingerprint.

Cite this