Browse > Article

리턴 스택 버퍼를 이용한 마이크로아키텍처 데이터 샘플링 공격  

Kim, Taehyun (광운대학교 컴퓨터공학과)
Shin, Youngjoo (고려대학교 정보보호학과)
Publication Information
Review of KIISC / v.31, no.1, 2021 , pp. 25-39 More about this Journal
Keywords
Citations & Related Records
연도 인용수 순위
  • Reference
1 Intel. Deep Dive: Intel Analysis of Microarchitect ural Data Sampling. https://software.intel.com/security-software-guidance/insights/deep-diveintel-analysis-microarchitectural-data-sampling, May 2019.
2 Intel. Side Channel Vulnerability MDS. https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html, May 2019.
3 Taehyun Kim, and Youngjoo Shin. Reinforcing Meltdown Attack by Using a Return Stack Buffer. IEEE Access, Vol. 7, pp. 186065-186077, 2019.   DOI
4 Yuval Yarom, and Katrina Falkner. Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack. In Proceedings of the 23rd USENIX Security Symposium, pp. 719-732, San Diego, CA, US, August 2014.
5 Gorka Irazoqui, Mehmet Sinan Inci, Thomas Eisenbarth, and Berk Sunar. Wait a minute! a fast, cross-VM attack on AES. In Symposium on Research in Attacks, Intrusions and Defenses (RAID), pp. 299-319, Gothenburg, Sweden, September 2014.
6 Daniel Gruss, Raphael Spreitzer, and Stefan Mangard. Cache template attacks: Automating attacks on inclusive last-level caches. In Proceedings of the 24th USENIX Security Symposium, pp. 897-912, Washington, DC, US, August 2015.
7 Yossef Oren, Vasileios P. Kemerlis, Simha Sethumadhavan, and Angelos D. Keromytis. The spy in the sandbox: Practical cache attacks in JavaScript and their implications. In Proceedings of the 2015 ACM Conference on Computer and Communications Security, pp. 1406-1418, Denver, CO, US, October 2015.
8 Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby B Lee. Last-level cache side-channel attacks are practical. In 2015 IEEE Symposium on Security and Privacy, pp. 605-622, San Jose, CA, US, May 2015.
9 Daniel Gruss, Clementine Maurice, Klaus Wagner, and Stefan Mangard. Flush+Flush: A fast and stealthy cache attack. In Proceedings of the 13rd Conference on Detection of Intrusions and Malware & Vulnerability Assessment, pp. 279-299, San Sebastian, Spain, July 2016.
10 Clementine Maurice, Manuel Weber, Michael Schwarz, Lukas Giner, Daniel Gruss, Carlo Alberto Boano, Kay Romer, and Stefan Mangard. Hello from the Other Side: SSH over Robust Cache Covert Channels in the Cloud. In Network and Distributed System Security Symposium, Vol. 17, pp. 8-11, San Diego, CA, US, February 2017.
11 Osvik, Dag Arne, Adi Shamir, and Eran Tromer. Cache attacks and countermeasures: the case of AES. In Cryptographers' track at the RSA conference, pp. 1-20, San Jose, CA, US, February 2006.
12 Craig Disselkoen, David Kohlbrenner, Leo Porter, and Dean Tullsen. Prime+Abort: A Timer-Free High-Precision L3 Cache Attack Using Intel TSX. In Proceedings of the 26th USENIX Security Symposium, pp. 51-67, Vancouver, BC, Canada, 2017.
13 Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, and Mike Hamburg. Meltdown: Reading Kernel Memory from User Space. In Proceedings of the 27th USENIX Security Symposium, pp. 973-990, Baltimore, MD, US, August 2018.
14 Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F. Wenisch, Yuval Yarom, and Raoul Strackx. Foreshadow: Extracting the keys to the intel {SGX} kingdom with transient out-of-order execution. In Proceedings of the 27th USENIX Security Symposium, pp. 991-1008, Baltimore, MD, US, August 2018.
15 Intel. L1 Terminal Fault. https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-faul, August 2018.
16 Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, and Daniel Gruss. A Systematic Evaluation of Transient Execution Attacks and Defenses. In Proceedings of the 28th USENIX Security Symposium, pp. 249-266, Santa Clara, CA, US, August 2019.
17 Stecklina, Julian. [RFC] x86/speculation: add L1 Terminal Fault / Foreshadow demo. https://lkml.org/lkml/2019/1/21/606, pp. 1-6,January 2019.
18 Ofir Weisse, Jo Van Bulck, Marina Minkin, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Raoul Strackx, Thomas F. Wenisch, and Yuval Yarom. Foreshadow-NG: Breaking the Virtual Memory Abstraction with Transient Out-of-Order Execution. https://foreshadowattack.eu/, pp. 1-7, August 2018.
19 Stecklina, Julian, and Thomas Prescher. Lazyfp: Leaking fpu register state using microarchitectural side-channels. arXiv preprint arXiv:1806.07480, pp. 1-6, July 2018.
20 Paul Kocher, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, and Yuval Yarom. Spectre Attacks: Exploiting Speculative Execution. In 2019 IEEE Symposium on Security and Privacy, pp. 1-19, San Francisco, CA, US, May 2019.
21 Michael Schwarz, Martin Schwarzl, Moritz Lipp and Daniel Gruss. NetSpectre: Read Arbitrary Memory over Network. In European Symposium on Research in Computer Security, pp. 279-299, Cham, Luxembourg, September 2019.
22 Guoxing Chen, Sanchuan Chen, Yuan Xiao, Yinqian Zhang, Zhiqiang Lin, and Ten H. Lai. SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution. In 2019 IEEE European Symposium on Security and Privacy, pp. 142-157, Stockholm, Sweden, July 2019.
23 Horn, Jann. speculative execution variant 4: speculative store bypass. https://bugs.chromium.org/p/project-zero/issues/detail?id=1528, August 2019.
24 Atri Bhattacharyya, Alexandra Sandulescu, Matthias Neugschwandtner, Alessandro Sorniotti, Babak Falsafi, Mathias Payer, and Anil Kurmus. SMoTherSpectre: exploiting speculative execution through port contention. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 785-800, London, UK, November 2019.
25 Esmaeil Mohammadian Koruyeh, Khaled N. Khasawneh, Chengyu Song, and Nael Abu-Ghazaleh. Spectre Returns! Speculation Attacks using the Return Stack Buffer. In 12th USENIX Workshop on Offensive Technologies (WOOT), pp. 1-12, Baltimore, MD, US, August 2018.
26 Giorgi Maisuradze, and Christian Rossow. ret2spec: Speculative execution using return stack buffers. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 2109-2122, Toronto, Canada, October 2018.
27 Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. RIDL: Rogue in-flight data load. In 2019 IEEE Symposium on Security and Privacy, pp. 88-105, San Francisco, CA, US, May 2019.
28 Michael Schwarz, Moritz Lipp, Daniel Moghimi, Jo Van Bulck, Julian Stecklina, Thomas Prescher, and Daniel Gruss. ZombieLoad: Cross-Privilege-Boundary Data Sampling. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 753-768, London, UK, November 2019.
29 Intel. Deep Dive: Intel Analysis of L1 Terminal Fault. https://software.intel.com/security-software-guidance/insights/deep-dive-intel-analysis-l1-terminal-fault, August 2018.
30 Claudio Canella, Daniel Genkin, Lukas Giner, Daniel Gruss1, Moritz Lipp, Marina Minkin, Daniel Moghimi, Frank Piessens, Michael Schwarz, Berk Sunar, Jo Van Bulck, and Yuval Yarom. Fallout: Leaking Data on Meltdown-resistant CPUs. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 769-784, London, UK, November 2019.
31 Intel. Rogue Data Cache Load / CVE-2017-5754, INTEL-SA-00088. https://software.intel.com/security-software-guidance/software-guidance/rogue-data-cache-load#mitigation, January 2018.
32 Daniel Gruss, Moritz Lipp, Michael Schwarz, Richard Fellner, Clementine Maurice, and Stefan Mangard. KASLR is Dead: Long Live KASLR. In International Symposium on Engineering Secure Software and Systems, pp. 161-176, Cham, Luxembourg, July 2017.
33 Intel. L1 Terminal Fault / CVE-2018-3615, CVE-2018-3620, CVE-2018-3646 / INTEL-SA-00161. https://software.intel.com/security-software-guidance/software-guidance/l1-terminal-fault, August 2018.