Ben Gras (Vrije Universiteit Amsterdam, Intel Corporation), Cristiano Giuffrida (Vrije Universiteit Amsterdam), Michael Kurth (Vrije Universiteit Amsterdam), Herbert Bos (Vrije Universiteit Amsterdam), Kaveh Razavi (Vrije Universiteit Amsterdam)
The past decade has seen a plethora of side channel attacks on various
CPU components. Each new attack typically follows a whitebox analysis
approach, which involves (i) identifying a specific shared CPU component,
(ii) reversing its behavior on a specific microarchitecture, and
(iii) surgically exploiting such knowledge to leak information (e.g.,
by actively evicting shared entries to monitor victim accesses). This
approach requires a deep understanding of the target component, obtained
by lengthy reverse engineering which needs to be repeated for each
new component and each microarchitecture. It also does not allow for
attacking shared resources that are unknown.
In this paper, we present ABSynthe, a system that takes a target
program and a microarchitecture as inputs and automatically synthesizes
new side channels. The key insight is that by limiting ourselves to
(typically on-core) contention-based side channels, we can treat the
target CPU microarchitecture as a black box, enabling automation. To
make ABSynthe possible, we have automatically generated leakage maps
for a variety of x86_64 microarchitectures. These leakage maps show a
complex picture and justify a black box approach to finding the best
sequence of instructions to cause information to leak from a software
target. This target is also treated and analyzed as a blackbox, to
find secret-dependent branches. To recover the secret information using
the optimized sequence of instructions, ABSynthe relies on a recurrent
neural network to craft practical side-channel attacks. Our evaluation,
somewhat counter-intuitively, shows that ABSynthe can synthesize better
attacks by exploiting contention on multiple components at the same time
compared to state of the art contention-based attacks that focus on a
single component. Concretely, the automation made possible by ABSynthe
allows us to synthesize cross-thread attacks in different settings and
for a variety of microarchitectures and cryptographic software targets,
in both native and virtualized environments.
We present results for Intel, AMD and ARM microarchitetures, and 4
different cryptographic targets. As an example, ABSynthe can recover a
full 256-bit EdDSA from just a single trace capture with 100% success
rate on Intel.