MAD: Microarchitectural Attacks and Defenses

In this short talk we discussed memory protection in modern Trusted Execution Environments and the role of logic isolation and/or cryptographic isolation in memory protection. The usage of deterministic encryption enables cipertext side-channel attacks that can be used to extract secrets from constant-time code. Cipherfix patches binaries by masking all writes of secret values with fresh pseudorandom masks, thereby preventing ciphertext side channels in the protected binary. The induced performance overhead is 2x and more for many workloads. It may serve as a lower bound of the expected costs of moving masking-style countermeasures to arbitrary binaries when trying to prevent arbitrary value leakage on server-grade CPUs, as recently exploited by the Hertzbleed attack.

In this talk, I plan to rant about some of the difficulties we faced in implementing leakage analyzers and mitigations in low-level compiler passes and in stand-alone binary analysis tools. These difficulties range from frustrations to soundness issues and arise from improper interfaces and abstractions as well as default assumptions binary analysis tools make that are improper for side-channel analysis. I will briefly discuss our thoughts on solutions but largely want to solicit discussion on better handling of these issues as we see more of these optimizations and accompanying defensive work.

In this talk, we discuss aspects of attacks from software leveraging microarchitectural features decomposed into multiple parts: We discuss the concept of attacks from software and argue that it ranges from attacks with physical access to attacks where the attacker does not even control a single line of code on the victim system. Thus, threat models for attacks from software vary widely. We discuss that the term microarchitecture also is used in different ways in different contexts: Often it refers specifically to the processor microarchitecture but it is increasingly used as a terminological counterpart to architecture, i.e., microarchitecture as the implementation of an architecture, including anything beneath the architectural interface. Finally, we discuss microarchitectural features that facilitate such attacks and the development trends underlying to the scientific progress in this field.

With the explosion of novel hardware optimizations, then used for attacks, has come a variety of hardware configuration options for those optimizations. A common approach is a simple on/off bit that can be set in a model specific register (MSR.)

Unfortunately, the preconditions for setting these bits, their effects, and their persistence are decidedly non-uniform. For software-based defenses that intend to use these bits to protect sensitive computation this presents several common problems. Rather than attempt to solve each configuration case on its own, we ask what an ideal simple configuration interface would look like for a compiler-based hardening scheme.

We draw parallels between speculative execution attacks and memory errors. Exploitation of memory errors has a long history, starting from the 1972 Anderson report. While the problem is much more close to being solved in a principled and practical way 50 years later, we have not quite succeeded. What are the lessons we can learn and apply for speculative execution defenses? A few topics of further discussion include “minimum viable patching” vs. principled defenses, attack chaining, attack reliability and portability, taxonomies inspired by memory errors.

Speculative execution attacks such as Spectre and Meltdown exploit microarchitectural optimizations to leak information across security domains. These vulnerabilities often stay undetected for years, because we lack the tools for systematic analysis of CPUs to find them.

In this talk I presented leakage contracts as a way to specify speculative leaks together with Revizor, a tool that can automatically test CPUs against these specifications. I gave examples of how this approach can be used to detect large classes of known and unknown leaks in recent x86 CPUs.

We will examine the RowHammer problem in Dynamic Random Access Memory (DRAM), the first example of how a circuit-level failure mechanism can cause a practical and widespread system security vulnerability. RowHammer is the phenomenon that repeatedly accessing a row in a modern DRAM chip predictably causes bitflips in physically-adjacent rows. Building on our initial fundamental work that appeared at ISCA 2014, Google Project Zero demonstrated that this hardware phenomenon can be exploited by user-level programs to gain kernel privileges. Many other works demonstrated other attacks exploiting RowHammer, including remote takeover of a server vulnerable to RowHammer, takeover of a mobile device by a malicious user-level application, and destruction of predictive capabilities of commonly-used deep neural networks.

Unfortunately, the RowHammer problem still plagues cutting-edge DRAM chips, DDR4 and beyond. Based on our recent characterization studies of more than 1500 DRAM chips from six technology generations that appeared at ISCA 2020 and MICRO 2021, we show that RowHammer at the circuit level is getting much worse, newer DRAM chips are much more vulnerable to RowHammer than older ones, and existing mitigation techniques do not work well. We also show that existing proprietary mitigation techniques employed in DDR4 DRAM chips, which are advertised to be Rowhammer-free, can be bypassed via many-sided hammering (also known as TRRespass & Uncovering TRR).

In this talk, we will provide an overview of RowHammer research in academia and industry, with a special focus on recent works that rigorously analyze real chip characteristics and introduce promising solution ideas. We will discuss the effect of RowHammer on High-Bandwidth Memory (HBM) chips and introduce and analyze RowPress, which is a fundamentally different read disturbance phenomenon that also affects all DRAM chips. RowPress greatly (e.g., by 100X) reduces the activation count required to induce bitflips, by keeping an activated row open for a long time. We will also discuss what other problems may be lurking in DRAM and other types of memory, which can potentially threaten the foundations of reliable and secure systems, as memory technologies scale to higher densities. We will conclude by describing and advocating a principled approach to memory robustness (including reliability, security, safety) research that can enable us to better anticipate and prevent such vulnerabilities.

• $\mathrm{■}$

  A short accompanying paper, which appeared at ASP-DAC 2023, can be found here and serves as recommended reading: “Fundamentally Understanding and Solving Row-Hammer” https://arxiv.org/abs/2211.07613.

• $\mathrm{■}$

  Slides: https://people.inf.ethz.ch/omutlu/pub/onur-DagStuhl-MAD-RowHammer-28-November-2023.pdf

• $\mathrm{■}$

  A similar talk online on Youtube: https://www.youtube.com/watch?v=0W7YRRhnunw

PIM systems, which enable various types of computation near (or using) memory structures, are gaining traction. We posit that, on the one hand, different types of PIM systems can cause new security issues, exacerbate known issues, or cause new complications related to security. On the other hand, PIM systems can be used to improve security properties by exposing data less, performing security critical functions in memory, or defining new (and physically smaller) trust boundaries in the system. This talk discusses challenges and opportunities in security of PIM systems.

Some related resources are mentioned below:

• $\mathrm{■}$

  A 2-page overview paper from DAC 2023: “Memory-Centric Computing”, https://arxiv.org/abs/2305.20000

• $\mathrm{■}$

  A short vision paper from DATE 2021: “Intelligent Architectures for Intelligent Computing Systems”, https://arxiv.org/abs/2012.12381

• $\mathrm{■}$

  A longer survey of modern memory-centric computing ideas and systems (updated August 2022): “A Modern Primer on Processing in Memory”, https://arxiv.org/abs/2012.03112

• $\mathrm{■}$

  Slides: https://people.inf.ethz.ch/omutlu/pub/onur-Dagstuhl-PIM-Security-28-November-2023.pdf

This lecture covers the reverse engineering of in-DRAM Target Row Refresh mechanisms and uses the insights in the development of advanced Rowhammer attacks that bypass these mitigations and the development of principled and scalable alternatives that are secure against these attacks.

For over two decades, cache attacks have been shown to pose a significant risk to the security of computer systems. In particular, a large number of works show that cache attacks provide a stepping stone for implementing transient-execution attacks. However, much less effort has been expended investigating the reverse direction—how transient execution can be exploited for cache attacks. In this work, we answer this question.

We first show that using transient execution, we can perform arbitrary manipulations of the cache state. Specifically, we design versatile logical gates whose inputs and outputs are the caching state of memory addresses. Our gates are generic enough that we can implement them in WebAssembly. Moreover, the gates work on processors from multiple vendors, including Intel, AMD, Apple, and Samsung. We demonstrate that these gates are Turing complete and allow arbitrary computation on cache states, without exposing the logical values to the architectural state of the program.

We then show two use cases for our gates in cache attacks. The first use case is to amplify the cache state, allowing us to create timing differences of over 100 millisecond between the cases that a specific memory address is cached or not. We show how we can use this capability to build eviction sets in WebAssembly, using only a low-resolution (0.1 millisecond) timer. For the second use case, we present the Prime+Scope attack, a variant of Prime+Probe that decouples the sampling of cache states from the measurement of said state. Prime+Store is the first timing-based cache attack that can sample the cache state at a rate higher than the clock rate. We show how to use Prime+Store to obtain bits from a concurrently executing modular exponentiation, when the only timing signal is at a resolution of 0.1 millisecond.

Rowhammer is a vulnerability affecting newer generations of DRAM (DDR3,DDR4,LPDDR4) where rapid activations of DRAM rows causes bit-flips in neighboring rows. Moreover, recent victim focused mitigation (refreshing victims neighboring aggressor rows) implemented in DDR4 have also been defeated by new attacks.

This talk discusses three recent Rowhammer mitigations proposing new aggressor-focused mitigations – Randomized Row Swap (RRS) [1], Scalable & Secure Row Swap (SRS) [2], and AQUA [3]. Based on learnings from these defenses, this talk summarizes the outlook for Rowhammer mitigations going forward.

Hardware-software (HW-SW) contracts are critical for high-assurance computer systems design and an enabler for software design/analysis tools that find and repair hardware-related bugs in programs. E.g., memory consistency models define what values shared memory loads can return in a parallel program. Emerging security contracts define what program data is susceptible to leakage via hardware side-channels and what speculative control- and data-flow is possible at runtime. However, these contracts and the analyses they support are useless if we cannot guarantee microarchitectural compliance, which is a “grand challenge.” Notably, some contracts are still evolving (e.g., security contracts), making hardware compliance a moving target. Even for mature contracts, comprehensively verifying that a complex microarchitecture implements some abstract contract is a time-consuming endeavor involving teams of engineers, which typically requires resorting to incomplete proofs.

Our work takes a radically different approach to the challenge above by synthesizing HW-SW contracts from advanced (i.e., industry-scale/complexity) processor implementations. In this talk, I present our work on: synthesizing security contracts from processor specifications written in Verilog; designing compiler approaches parameterized by these contracts that can find and repair hardware-related vulnerabilities in programs; and updating hardware microarchitectures to support scalable verification and efficient security-hardened programs.

Microarchitectural side-channel attacks often face challenges due to limited temporal resolution. Researchers have innovatively employed timer and inter-processor interrupts to temporarily halt victim programs, allowing precise probing of microarchitectural buffers. This technique, while not exclusive to Trusted Execution Environments (TEEs), has demonstrated particular efficacy in such environments.

In this presentation, I share my experiences developing SGX-Step, an open-source framework enabling precise interrupt capabilities within Intel’s SGX TEE. I outline specific attack applications of SGX-Step in recent years and its significant impact on the design of effective defenses. Drawing from a thorough root-cause analysis, I explain our collaboration with Intel to devise a hardware-software co-design effectively countering SGX-Step’s ability to single-step a victim enclave. Additionally, I highlight our efforts in designing defenses across the system stack for embedded MSP430 Sancus TEE processors. The talk aims to provide insights into interrupt-driven attack evolution and key design choices for mitigating their effects.

In this presentation, we introduce hardware, i.e. physical attacks on electronic circuits. With physical security, we mean sensitive information that can be obtained by monitoring or disturbing the physical behavior of the electronic circuit. A first class of attacks are based on passive observation of the data-dependent variations in timing, power consumption or EM emanation. The strength of these attacks is that the device under attack is not aware that it is being observed. A second class of attacks, called fault attacks, actively manipulate the behavior of the integrated circuits. Examples are clock or power glitching, cooling or heating, laser or EM injection, row hammering and more. The effect of these attacks could be transient or permanent. In a second part of the presentation, we give an overview of the effort and lab set-up which is needed to perform these attacks, ranging from simple cheap power probes to laser and FIB set-ups, both for passive and active attacks. In the last part we discussed countermeasures to protect against passive side-channel and active fault attacks against crypto implementations. Countermeasures are split into two main classes. One is hiding, where the goal is to reduce the signal-to-noise ratio of sensitive data. Examples are logic styles as WDDL, clock jitter, instruction shuffling, etc. The second is masking, where sensitive data is randomly split in shares. Operations then work on randomized data and the signal traces do not contain sensitive data that can directly be correlated to the sensitive data. Higher order attacks require higher order masking, i.e. split in a larger number of shares. Countermeasures against fault attacks include on-chip sensors at the circuit level, redundance and error correcting codes at the algorithm level. Unfortunately, countermeasures against one class of attacks might make the circuit vulnerable to the other class of attacks. Countermeasures resistant to both classes of attacks remain a big research challenge.