View the slides

72 Pages·2016·0.45 MB·English

www.iaik.tugraz.at
ARMageddon:
Cache Attacks on Mobile Devices
MoritzLipp,DanielGruss,RaphaelSpreitzer,Cle´mentineMaurice,StefanMangard
GrazUniversityofTechnology
August11,2016—UsenixSecurity2016
DanielGruss,GrazUniversityofTechnology
1 August11,2016—UsenixSecurity2016
We identified and solved challenges systematically to:
make all cache attack techniques applicable to ARM
monitor user activity
attack weak Android crypto
show that ARM TrustZone leaks through the cache
www.iaik.tugraz.at
TLDR
powerful cache attacks (like Flush+Reload) on x86
why not on ARM?
DanielGruss,GrazUniversityofTechnology
2 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
TLDR
powerful cache attacks (like Flush+Reload) on x86
why not on ARM?
We identified and solved challenges systematically to:
make all cache attack techniques applicable to ARM
monitor user activity
attack weak Android crypto
show that ARM TrustZone leaks through the cache
DanielGruss,GrazUniversityofTechnology
2 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (1)
cache hits cache misses
s 107
e
s
s
e
c 105
c
a
f
o 103
r
e
b
m
u 101
N
50 100 150 200 250 300 350 400
Access time in CPU cycles
DanielGruss,GrazUniversityofTechnology
3 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (2)
DanielGruss,GrazUniversityofTechnology
4 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (2)
DanielGruss,GrazUniversityofTechnology
4 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (2)
DanielGruss,GrazUniversityofTechnology
4 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (2)
DanielGruss,GrazUniversityofTechnology
4 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (2)
DanielGruss,GrazUniversityofTechnology
4 August11,2016—UsenixSecurity2016
www.iaik.tugraz.at
What is a cache attack? (2)
DanielGruss,GrazUniversityofTechnology
4 August11,2016—UsenixSecurity2016