Side-Channel Attacks on
Everyday Applications
Taylor Hornby†‡(With thanks to Prof. John Aycock†)

University of Calgary†
Zcash‡

T. Messerges et al. CHES, 1999.

A. White et al. IEEE S&P, 2011.

D. Genkin et al. CRYPTO, 2014.

Side channels affect more than crypto.

M. Backes, et al. USENIX Security, 2010.

M. Lipp et al. USENIX Security, 2016.

A New Attack● Continue the “non-crypto” trend.
● Download my code and make better attacks!

Input Distinguishing Attack
1. Victim runs a program on input A or B or C.
2. Attacker wants to know which one.

I need tolook up ear
infections...

Strep, ear
infection, orchickenpox?

SSH

Alice

ScarletAha! Earinfection!

Interesting.

SSHEAR
INFECTION

Unprivileged
Spy Tool

Alice

ScarletBackground: Flush+Reload

Flush+Reload Breaking Crypto● 2013/2014: “Flush+Reload: A High-Resolution, Low
Noise, L3 Cache Side Channel Attack.
● 2014: “Recovering OpenSSL ECDSA Nonces Using the
Flush+Reload Cache Side-Channel Attack”● 2014: “Wait a Minute! A fast, Cross-VM Attack on AES”
● Lots more!

But Flush+Reload can do more.

Y. Zhang et al. CCS, 2014.

D. Gruss et al. USENIX Security, 2015.

M. Lipp et al. USENIX Security, 2016.

Alice Virtual

DRAM

Flush+Reload by
Y. Yaram, K. Falkner.

RO

Alice Virtual

Scarlet Virtual

DRAM

Flush+Reload by
Y. Yaram, K. Falkner.

RO

Alice Virtual

Scarlet Virtual

CACHE DRAM

Flush+Reload by
Y. Yaram, K. Falkner.

RO

Alice Virtual

CACHE DRAM

Flush+Reload by
Y. Yaram, K. Falkner.

EIP

Scarlet VirtualRO

Alice Virtual

CACHE DRAM

Flush+Reload by
Y. Yaram, K. Falkner.

EIP

Scarlet VirtualREAD

FASTRO

Alice Virtual

CACHE DRAM

Flush+Reload by
Y. Yaram, K. Falkner.

EIPScarlet VirtualROSTFAWREADREADO
SL

foo() {...
}
bar() {...
}
baz() {...
}

Flush+Reload by
Y. Yaram, K. Falkner.

foo() {...
}
bar() {...
}
baz() {...
}

Flush+Reload by
Y. Yaram, K. Falkner.

Flush+Reload by
Y. Yaram, K. Falkner.

foo() {...
}

FLUSH

bar() {...
}

FLUSH

baz() {...
}

FLUSH

foo() {...
}
bar() {...
}
baz() {...
}

Flush+Reload by
Y. Yaram, K. Falkner.

Flush+Reload by
Y. Yaram, K. Falkner.

foo() {...
}

FLUSHbar() {...
}

FLUSH

baz() {...
}

FLUSH

foo() {...
}
bar() {...
}
baz() {...
}

Flush+Reload byY. Yaram, K. Falkner.

Aha! Earinfection!

Interesting.

SSH

EAR
INFECTION

Unprivileged
Spy Tool

Alice

ScarletPut “light bulbs” on the HTML parser:●●●●

html_stack_item()
html_stack_dup()
html_a()parse_html()

BDBCBCABABABACBABABCBABACBABCACABCBCACACABCABABCABCACABCBCABACACADBABDBCABDBCACBCABDBCABDBCABDBCABCABCBCBCABCACABDCBDBCBABABDCBDBCABDACBDBCBCBABABCBCABCACBCBCBACBABACBACBABDBCABDBCABDBCABCBCBCBCABCABCBCABDABDCBCACBCACACBCABDABDBCABDBCABDBCBCABCABDBCABDBCABCABDBCABDBCABCABDBCABDBCABCABDBCABDBCABCABCBDBCABDBCABABDBCACBCABCBCABCABDBDBCBCABCABDABDBCBCABCABCBCABCABCABDBCABDACBDBCABDBCABACBDBCABDBCABDCABDBCBCABCACBCABCABDBCABCABDABCBCABDBCBCBABABCBCABCABCBCBCBABACABABACBABDACBDBCABDBCABDBCBCABCBCABCBCABCABCBCABDBDBCBCABCABCABCACABDACBDCACBDCACBDBCBCACBCBCABDBCABDBCACBCABDBCABDBCBCABCABDBCABCABDCABDCABCACBCBCABDADBCBCABDBCABCABCACBCACBCACABDABDBCABCBCABCABDBCBCACBCBCABCABCABCABCBDBCABDBCABACBDBCABDBCABDBCABDBCABCABCACBCABABCBCACBABCABDBDBCBCBCBACBABACBABCABCABCBCBCBCABABACBACBABCABDABCACBDABCABDABCBCABACABCBCABABCABCBCABCBCABDABCBACACACABACABDBDBCABDBCABDBABCABCBCABDBACABDBABCABACABACABDABCBACABCABDBCBACABDBACABDBABABCABCABCABABDBCBCABDABCABCBCBABCBCBACABDBCABCABCBCABDABCABCABCABCABACABCBCABDA.
B.
C.
D.

html_stack_item()
html_stack_dup()
html_a()parse_html()

Goal: Recognize this as the EarInfection Wikipedia page.

Attack Stages:
1. Training - Scarlet spies on herself.
2. Spying - Scarlet spies on Alice.
3. Identification - Most similar by Levenshtein distance.

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 1: Training

Strep throatEar infection
Chickenpox

Stage 1: Training

Strep throat
Ear infection
Chickenpox

Stage 2: Spying

Strep throat
Ear infection
Chickenpox?

Stage 3: Identification

Strep throat
Ear infection
Chickenpox?

Stage 3: Identification

Strep throat
Ear infection
Chickenpox!

Output: “Ear infection”

>90% Success(100 pages, 10 samples)

It’s demo time.

https://defuse.ca/BH2016

Q&A
https://defuse.ca/BH2016