2019

Packet Chasing: Spying on Network Packets over a Cache Side-Channel

Taram, Mohammadkazem, Venkat, Ashish, Tullsen, Dean

Understand

This paper presents Packet Chasing, an attack on the network that does not require access to the network, and works regardless of the privilege level of the process receiving the packets.

A spy process can easily probe and discover the exact cache location of each buffer used by the network driver.
Even more useful, it can discover the exact sequence in which those buffers are used to receive packets.
This then enables packet frequency and packet sizes to be monitored through cache side channels.

Built on

C. G. Girling, “Covert channels in lan’s,” IEEE Transactions on software engineering
1987
Earlier work this paper cites.
https://www.tcpdump.org
V. Jacobson, C. Leres, and S. McCanne, “Tcpdump/libpcap,” Accessed: Aug 2019 · 1987
Earlier work this paper cites.
T. G. Handel and M. T. Sandford, “Hiding data in the osi network model,” in International Workshop on Information Hiding
1996
Earlier work this paper cites.
C. H. Rowland, “Covert channels in the tcp/ip protocol suite,” First Monday
1997
Earlier work this paper cites.
Prentice Hall PTR, 1st ed., 2000
D. Jurafsky and J. H. Martin, Speech and Language Processing: An Introduction to Natural Language Processing, Computational Linguistics, and Speech Recognition · 2000
Earlier work this paper cites.
C. Abad, “Ip checksum covert channels and selected hash collision,” 2001
2001
Earlier work this paper cites.
S. D. Servetto and M. Vetterli, “Communication using phantoms: covert channels in the internet,” in IEEE International Symposium on Information Theory (ISIT)
2001
Earlier work this paper cites.
Presentation at DEFCON
A. Hintz, “Covert channels in tcp and ip headers,” 2002 · 2002
Earlier work this paper cites.
D. Kundur and K. Ahsan, “Practical internet steganography: data hiding in ip,” Multimedia and Security Workshop
2003
Earlier work this paper cites.
S. Cabuk, C. E. Brodley, and C. Shields, “Ip covert timing channels: design and detection,” in 11th ACM conference on Computer and communications security (CCS)
2004
Earlier work this paper cites.
R. Huggahalli, R. Iyer, and S. Tetrick, “Direct cache access for high bandwidth network i/o,” in 32nd International Symposium on Computer Architecture (ISCA)
2005
Earlier work this paper cites.
N. B. Lucena, G. Lewandowski, and S. J. Chapin, “Covert channels in ipv6,” in International Workshop on Privacy Enhancing Technologies
2005
Earlier work this paper cites.
D. J. Bernstein, “Cache-timing attacks on aes,” 2005
2005
Earlier work this paper cites.
D. A. Osvik, A. Shamir, and E. Tromer, “Cache attacks and countermeasures: The case of aes,” in Topics in Cryptology (CT-RSA)
2006
Earlier work this paper cites.
N. L. Binkert, R. G. Dreslinski, L. R. Hsu, K. T. Lim, A. G. Saidi, and S. K. Reinhardt, “The M5 Simulator: Modeling Networked Systems,” Micro, IEEE
2006
Earlier work this paper cites.
S. Zander, G. Armitage, and P. Branch, “A survey of covert channels and countermeasures in computer network protocols,” IEEE Communications Surveys & Tutorials
2007
Earlier work this paper cites.
Z. Wang and R. B. Lee, “New cache designs for thwarting software cache-based side channel attacks,” in 34th Annual International Symposium on Computer Architecture (ISCA)
2007
Earlier work this paper cites.
L. Tan, E. M. Chan, R. Farivar, N. Mallick, J. C. Carlyle, F. M. David, and R. H. Campbell, “ikernel: Isolating buggy and malicious device drivers using hardware virtualization support,” in 3rd IEEE International Symposium on Dependable, Autonomic and Secure Computing (DASC)
2007
Earlier work this paper cites.
Available online: http://netweb.usc.edu/%7ersinha/pkt-sizes/
R. Sinha, C. Papadopoulos, and J. Heidemann, “Internet packet size distributions: Some observations,” Tech. Rep. ISI-TR-2007-643, USC/Information Sciences Institute, 2007 · 2007
Earlier work this paper cites.
Available at http://www.intel.com/content/dam/doc/white-paper/performance-2nd-generation-core-vpro-family-paper.pdf
Intel Corporation, “2nd Generation Intel Core vPro Processor Family,” 2008 · 2008
Earlier work this paper cites.
W. Reese, “Nginx: The high-performance web server and reverse proxy,” Linux J
2008
Earlier work this paper cites.
D. Tang, Y. Bao, W. Hu, and M. Chen, “Dma cache: Using on-chip storage to architecturally separate i/o data from cpu data for improving i/o performance,” in 16th International Symposium on High-Performance Computer Architecture (HPCA)
2010
Earlier work this paper cites.
S. Boyd-Wickizer and N. Zeldovich, “Tolerating malicious device drivers in linux,” in USENIX Annual Technical Conference (USENIX ATC)
2010
Earlier work this paper cites.
M. Tiwari, J. K. Oberg, X. Li, J. Valamehr, T. Levin, B. Hardekopf, R. Kastner, F. T. Chong, and T. Sherwood, “Crafting a usable microkernel, processor, and i/o system with strict and provable information flow security,” in 38th International Symposium on Computer Architecture (ISCA)
2011
Earlier work this paper cites.
Intel Corporation, “Intel ® Data Direct I/O Technology (Intel ® DDIO): A Primer,” 2012
2012
Earlier work this paper cites.
https://www.realworldtech.com/sandy-bridge-ep/2/
D. Kanter, “Sandy bridge-ep launches,” 2012 · 2012
Earlier work this paper cites.
Z. Wu, Z. Xu, and H. Wang, “Whispers in the hyper-space: High-speed covert channel attacks in the cloud,” in 21st USENIX Security Symposium (USENIX Security)
2012
Earlier work this paper cites.

Similar

I. Marinos, R. N. M. Watson, and M. Handley, “Network stack specialization for performance,” in 12th ACM Workshop on Hot Topics in Networks (HotNets)
2013
Cited alongside, same era.
J. Oberg, S. Meiklejohn, T. Sherwood, and R. Kastner, “A practical testing framework for isolating hardware timing channels,” in Design, Automation & Test in Europe Conference & Exhibition (DATE)
2013
Cited alongside, same era.
Y. Yarom and K. Falkner, “Flush+ reload: A high resolution, low noise, l3 cache side-channel attack.,” in 23rd USENIX Security Symposium (USENIX Security)
2014
Cited alongside, same era.
X. Li, V. Kashyap, J. K. Oberg, M. Tiwari, V. R. Rajarathinam, R. Kastner, T. Sherwood, B. Hardekopf, and F. T. Chong, “Sapper: A language for hardware-level security policy enforcement,” in 19th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)
2014
Cited alongside, same era.
X. Zhou, Y. Lee, N. Zhang, M. Naveed, and X. Wang, “The peril of fragmentation: Security hazards in android device driver customizations,” in 35th IEEE Symposium on Security and Privacy (S&P)
2014
Cited alongside, same era.
S. Li, H. Lim, V. W. Lee, J. H. Ahn, A. Kalia, M. Kaminsky, D. G. Andersen, O. Seongil, S. Lee, and P. Dubey, “Architecting to achieve a billion requests per second throughput on a single key-value store server platform,” in 42nd International Symposium on Computer Architecture (ISCA)
2015
Cited alongside, same era.
F. Liu, Y. Yarom, Q. Ge, G. Heiser, and R. B. Lee, “Last-level cache side-channel attacks are practical,” in 36th IEEE Symposium on Security and Privacy (S&P)
2015
Cited alongside, same era.
D. Gruss, R. Spreitzer, and S. Mangard, “Cache template attacks: Automating attacks on inclusive last-level caches,” in 24th USENIX Security Symposium (USENIX Security)
2015
Cited alongside, same era.
Y. Oren, V. P. Kemerlis, S. Sethumadhavan, and A. D. Keromytis, “The spy in the sandbox: Practical cache attacks in javascript and their implications,” in 22nd ACM Conference on Computer and Communications Security (CCS)
2015
Cited alongside, same era.
C. Maurice, N. Le Scouarnec, C. Neumann, O. Heen, and A. Francillon, “Reverse engineering intel last-level cache complex addressing using performance counters,” in International Symposium on Recent Advances in Intrusion Detection
2015
Cited alongside, same era.
Y. Yarom, Q. Ge, F. Liu, R. B. Lee, and G. Heiser, “Mapping the intel last-level cache.,” IACR Cryptology ePrint Archive
2015
Cited alongside, same era.
G. Irazoqui, T. Eisenbarth, and B. Sunar, “Systematic reverse engineering of cache slice selection in intel processors,” in Euromicro Conference on Digital System Design
2015
Cited alongside, same era.

Then

Z. Zhu, S. Kim, Y. Rozhanski, Y. Hu, E. Witchel, and M. Silberstein, “Understanding the security of discrete gpus,” in Proceedings of the General Purpose GPUs (GPGPU)
2017
Later among the works it cites.
https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/ethernet-controller-i350-datasheet.pdf
Intel Corporation, “Intel ® ethernet controller i350 datasheet,” 2017 · 2017
Later among the works it cites.
M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, A. Fogh, J. Horn, S. Mangard, P. Kocher, D. Genkin, Y. Yarom, and M. Hamburg, “Meltdown: Reading kernel memory from user space,” in 27th USENIX Security Symposium (USENIX Security)
2018
Later among the works it cites.
F. Dall, G. De Micheli, T. Eisenbarth, D. Genkin, N. Heninger, A. Moghimi, and Y. Yarom, “Cachequote: Efficiently recovering long-term secrets of sgx epid via cache attacks,” IACR Transactions on Cryptographic Hardware and Embedded Systems
2018
Later among the works it cites.
V. Kiriansky, I. Lebedev, S. Amarasinghe, S. Devadas, and J. Emer, “Dawg: A defense against cache timing attacks in speculative execution processors,” in 51st IEEE/ACM International Symposium on Microarchitecture (MICRO)
2018
Later among the works it cites.
O. Oleksenko, B. Trach, R. Krahn, M. Silberstein, and C. Fetzer, “Varys: Protecting SGX enclaves from practical side-channel attacks,” in USENIX Annual Technical Conference (USENIX ATC )
2018
Later among the works it cites.
M. Taram, A. Venkat, and D. Tullsen, “Mobilizing the micro-ops: Exploiting context sensitive decoding for security and energy efficiency,” in 45th Annual International Symposium on Computer Architecture (ISCA)
2018
Later among the works it cites.
V. Rimmer, D. Preuveneers, M. Juarez, T. Van Goethem, and W. Joosen, “Automated website fingerprinting through deep learning,” in 25th Network and Distributed System Security Symposium (NDSS)
2018
Later among the works it cites.
Online; accessed Jun 2018
W. Glozer, “wrk - a HTTP benchmarking tool.” https://github.com/wg/wrk · 2018
Later among the works it cites.
P. Kocher, J. Horn, A. Fogh, , D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks: Exploiting speculative execution,” in 40th IEEE Symposium on Security and Privacy (S&P)
2019
Closest in time.
A. Farshin, A. Roozbeh, G. Q. Maguire, Jr., and D. Kostić, “Make the most out of last level cache in intel processors,” in 14th EuroSys Conference (EuroSys 19)
2019
Closest in time.
D. Wang, A. Neupane, Z. Qian, N. B. Abu-Ghazaleh, S. V. Krishnamurthy, E. J. M. Colbert, and P. Yu, “Unveiling your keystrokes: A cache-based side-channel attack on graphics libraries,” in Network and Distributed System Security Symposium (NDSS)
2019
Closest in time.
A. Shusterman, L. Kang, Y. Haskal, Y. Meltser, P. Mittal, Y. Oren, and Y. Yarom, “Robust website fingerprinting through the cache occupancy channel,” in 28th USENIX Security Symposium (USENIX Security)
2019
Closest in time.
G. Saileshwar and M. K. Qureshi, “Lookout for zombies: Mitigating flush+reload attack on shared caches by monitoring invalidated lines,” CoRR
Original
2019
Closest in time.
M. Taram, A. Venkat, and D. Tullsen, “Context-sensitive fencing: Securing speculative execution via microcode customization,” in Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)
2019
Closest in time.
M. Taram, A. Venkat, and D. M. Tullsen, “Context-sensitive decoding: On-demand microcode customization for security and energy management,” IEEE Micro
2019
Closest in time.
M. Taram, D. Tullsen, A. Venkat, H. Sayadi, H. Wang, S. Manoj, and H. Homayoun, “Fast and efficient deployment of security defenses via context sensitive decoding,” in Proceedings of the 44th Government Microcircuit Applications and Critical Technology Conference (GOMACTech)
2019
Closest in time.
A. T. Markettos, C. Rothwell, B. F. Gutstein, A. Pearce, P. G. Neumann, S. W. Moore, and R. N. M. Watson, “Thunderclap: Exploring vulnerabilities in operating system IOMMU protection via DMA from untrustworthy peripherals,” in Network and Distributed Systems Security Symposium (NDSS)
2019
Closest in time.
Online: https://downloadcenter.intel.com/download/13663/Intel-Network-Adapter-Driver-for-82575-6-82580-I350-and-I210-211-Based-Gigabit-Network-Connections-for-Linux-
Intel Corporation, “Intel gigabit etherenet driver,” 2019 · 2019
Closest in time.
Online: http://i.dell.com/sites/doccontent/shared-content/data-sheets/en/Documents/dell-poweredge-t620-technical-guide.pdf
Dell, “Poweredge t620 technical guide,” 2013 · 2019
Closest in time.
Online: https://cs.adelaide.edu.au/~yval/Mastik/
Y. Yarom, “Mastik: A micro-architectural side-channel toolkit,” 2016 · 2019
Closest in time.
Online: https://www.kernel.org/doc/Documentation/DMA-API.txt
J. E. Bottomley, “Linux kernel dma api,” 2019 · 2019
Closest in time.
Accessed Aug 2019 http://man7.org/linux/man-pages/man7/raw.7.html
M. Kerrisk, “Linux programmer’s manual.” · 2019
Closest in time.
Accessed Aug 2019 https://www.cisco.com/c/en/us/about/security-center/network-performance-metrics.html
C. S. R. . Operations., “Bandwidth, packets per second, and other network performance metrics.” · 2019
Closest in time.
Accessed Aug 2019 http://mathworld.wolfram.com/Cross-Correlation.html
E. W. Weisstein, “Cross-correlation. from mathworld–a wolfram web resource. lessons in digital estimation theory,” 2019 · 2019
Closest in time.
M. Kurth, B. Gras, D. Andriesse, C. Giuffrida, H. Bos, and K. Razavi, “NetCAT: Practical Cache Attacks from the Network,” in 41st IEEE Symposium on Security and Privacy (S&P)
2020
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…