Shielding Software From Privileged Side-Channel Attacks

on YouTube ↗24m

" summary

Defends against page-table and last-level-cache side channels a compromised OS can launch by removing page-table mappings from the kernel dirac map, disabling lazy allocation for a secure user space, and partitioning the LLC with Intel Cache Allocation Technology. Prototype Apparition builds on an optimized Virtual Ghost, forces kernel instrumentation, and manages physical allocation. Evaluation on FreeBSD shows defenses add 1–18% overhead (one app up to 86% in paper) and blocks page-fault and Prime+Probe leakage.

AI-written summary · about

" chapters (18)

1. 0:00Intro
2. 0:43OS-Launched Side-Channel Attacks
3. 1:52Why Shielding Systems Don't Help
4. 2:33Outline
5. 3:03Page Table Side Channels
6. 3:59LLC Side Channel: Prime + Probe Attack
7. 5:52Background on Virtual Ghost
8. 6:53Protected Memory Regions
9. 7:39Apparition
10. 9:17Paging Side Channels Defenses
11. 10:35Intel Cache Allocation Technology
12. 11:26Cache Partitioning Configuration
13. 12:32Private Cache Partitions for Applications
14. 13:37Spectre and Meltdown Attacks
15. 14:23Methodology
16. 15:43Page Table Side-Channel Defenses Overheads
17. 18:40LLC Side-Channel Defenses Overheads
18. 19:54Conclusion

" related talks

• 30mProactive Software Defense against Side Channel AttacksKristen Accardi · Linux Security Summit North America 2018
• 28mStrong and Efficient Cache Side-Channel Protection...Felix Schuster, Daniel Gruss, Manuel Costa, Julian Lettner, Olya Ohrimenko, Istvan Haller · 26th USENIX Security Symposium (USENIX Security '17)
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 38mTaking Kernel Hardening to the Next LevelTaesoo Kim, Jinbum Park, Haehyun Cho, Seolheui Kim, Yeji Kim, Bumhan Kim, Sungbae Yoo · Black Hat Asia 2022
• 36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented ProgrammingSeunghun Han · Black Hat USA 2023
• 43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the ProcessDaniel Gruss, Anders Fogh · Black Hat USA 2016
• 25mTelling Your Secrets without Page Faults...Raoul Strackx, Frank Piessens, Jo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza · 26th USENIX Security Symposium (USENIX Security '17)