Are Cache Attacks on Public Clouds Practical?

Transcription

1 Are Cache Attacks on Public Clouds Practical? Thomas Eisenbarth Joint work with Gorka Irazoqui, Mehmet Sinan Inci, Berk Gulmezoglu and Berk Sunar WPI - 10/19/2015

2 Outline Cloud Computing and Isolation Extracting Information from Co-located VM Attacking AES across VM Boundaries A Practical RSA Key Recovery 2

3 Cloud Computing Computation increasingly outsourced to cloud servers CSPs: many users on shared, homogeneous platforms Users rent VMs, share same computer Shared resources Information Leakage? 3

4 Security through Isolation Virtual machines: Abstraction of physical machine Hypervisor (VMM) ensures Isolation through virtualization VMs might feel each other s load on some low-level resources potential side channels Guest Victim OS #1 Guest Spy OS #2 VM VM VMM Hardware 4

5 Outline Cloud Computing and Isolation Extracting Information from Co-located VM Attacking AES across VM Boundaries A Practical RSA Key Recovery 5

6 Cross-VM Side Channel Attack Suitable covert channel in the cloud? Cross Core: Last Level Cache (L3 Cache) accesses Adversary and victim share full access to L3 cache Cache Access cannot be virtualized (70x slowdown) 6

7 How to track victim s data? Deduplication Keeps only one copy of duplicate data in RAM Kernel Same page Merging in Linux and KVM Transparent Page Sharing in VMware VMM Solutions for Xen available as well Is now an opt-in feature for VMMs! (Default for OSs) Source: When Target VM accesses page page copied to cache: copy in shared LLC Subsequent Spy VM access also faster! Spy can detect Target VMs accesses to known pages 7

8 Steps: Flush+Reload Attack: Concept 1. Flush desired memory lines 2. Wait for some time 3. Reload memory lines and measure reload time. Private L1/L2 CACHE Shared L3 CACHE Victim Spy Slow reload time Fast reload time Clean detection if monitored memory line was accessed Memory 8

9 Outline Cloud Computing and Isolation Extracting Information from Co-located VM Attacking AES across VM Boundaries A Practical RSA Key Recovery 9

10 Target Cipher: AES AES T-table implementation: SubBytes ShiftRows T-table & XOR MixColumns T-tables stored in memory/cache Idea: Detect T-table accesses in last round ciphertext mapping to monitored table position is always accessed Inclusive caches ensure T-table in LLC T table Memory 10

11 Test setup Intel i Attack Setup and Results OpenSSL1.0.1f AES C implementation Ubuntu OS VMware ESXI 5.5 Transparent Page Sharing enabled (NO LONGER default) Measurements take less than a minute! [IIES14] Irazoqui, G., Inci, M. S., Eisenbarth, T., & Sunar, B. Wait a minute! A fast, Cross-VM attack on AES. RAID [GIIES15] Gulmezoglu, B., Irazoqui, G., Inci, M., Eisenbarth, T., & Sunar, B. A Faster and More Realistic Flush+ Reload Attack on AES. COSADE 2015

12 Are Cross-VM Cache Attacks Realistic? Cross-VM Flush+Reload Attack on AES works if Server has a shared level of cache Attacker and the victim are physically colocated VMM implements memory deduplication Memory Deduplication can enable Cross-VM cache attacks 12

13 Cache Attacks without Deduplication? Cache attacks are old [Hu92] General technique: Prime+Probe [OST06]: 1. Flush Prime desired memory lines fill monitored cache lines with data making an eviction set 2. Wait for some time 3. Reload Probe memory lines read eviction set data and time read Problems: Usually only applied on L1-Cache not cross-core L3-Cache is too large (25MB vs 64kB) and cannot be controlled by spy [Hu92] Hu, W.-M. (Digital Equipment Corp., Littleton, MA, USA) Lattice scheduling and covert channels. IEEE Oakland 92 OST06] DA Osvik, A Shamir, E Tromer Cache attacks and countermeasures: the case of AES. CT-RSA

14 Classic: Prime+ Probe in L1 Cache Eviction Set fills one cache set (dummy data) Intel: L1$ is virtually indexed and physically tagged attacker controls/knows set number Eviction set is easily constructed Not true for LLC: set index is part of virtual address Cache tag Set Byte 14

15 Prime + Probe in LLC How to gain control over LLC? Huge memory pages! 2MB pages instead of 4 KB. Offset becomes 21 bits Eviction set for L3$ can be constructed 15

16 LLC Prime+Probe on AES Same target as before (Single line of T-Table) Preparation: Need to locate T-Table in LLC TestSetup 1: Intel I cores Xen and Vmware + Ubuntu TestSetup 2: Intel e cores Vmware + Ubuntu [IES15] Irazoqui, G., Eisenbarth, T., & Sunar, B. S$A: A shared cache attack that works across cores and defies VM sandboxing and Its application to AES. 36th IEEE Symposium on Security and Privacy (S&P 2015) [LY+15] Liu, F., Yarom, Y., Ge, Q., Heiser, G., & Lee, R. B. (2015). Last-Level Cache Side-Channel Attacks are Practical. (S&P 2015). 16

17 Are Cross-VM Cache Attacks Realistic? Cross-VM Flush+Reload Attack on AES works if Server has a shared level of cache Attacker and the victim are physically colocated VMM implements memory deduplication 17

18 Outline Cloud Computing and Isolation Extracting Information from Co-located VM Attacking AES across VM Boundaries AES Attack #2: Without Deduplication A Practical RSA Key Recovery 18

19 Co-location First (and last) success in 2009 [RTS09]: 1. Launch many instances on cloud 2. Check if any are co-located * In Sept 2008 How to detect Co-location? Ping time? IP address of instance or hypervisor? Disk Load? [RTSS09] Ristenpart, T., Tromer, E., Shacham, H., and Savage, S. Hey, You, Get off of My Cloud: Exploring Information Leakage in Thirdparty Compute Clouds. ACM CCS '09 19

20 Test Setup AWS EC2 m2.medium instances: Intel Xeon E v2 GHz 10 cores share 25 MB of L3 cache Modified (Hardened) Xen VMM Up to 10 co-located instances (VMs) 4 accounts w/ 20 instances (no within-acc colocation) Ping is constant time HDDs replaced with SSDs Dom0 IPs hidden New Co-location detection needed 20

21 LLC Noise Co-Location Attempt: LLC Cache Accesses + Works reliable and we know how to do it + Impossible * to block - Requires slice recovery - Noise? Friday Monday Tuesday Average Gives Reliable Co-location Detection ensures that cache attack will work Alternative: Memory bus contention [XWW15,VZRS15] 00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00 Hour of Day (EST) [XWW15] XU, Z., WANG, H., AND WU, Z. A measurement study on co-residence threat inside the cloud. USENIX Security 15 [VZRS15] VARADARAJAN, V., ZHANG, Y., RISTENPART, T., AND SWIFT, M. A placement vulnerability study in multi-tenant public clouds. USENIX Security 15 22

22 Target Cryptosystem Libgcrypt s RSA implementation RSA CRT with 2048 bit modulus size Sliding window exponentiation (5 bits) Message blinding to prevent chosen ciphertext attacks Is this state-of-the-art? Libgcrypt (February 2015) Table accesses now constant execution flow (no more cache games) 23

23 Attack on RSA-CRT Sliding Window 1. Find cache trace of sliding window multiplicands 2. Observe several exponentiations to reduce noise 3. Align observations to reduce noise 4. Run error correcting key recovery to fix errors introduced by noise 24

24 Reload time Reload time Reload time Identifying a Correct Cache Line 10x2048 cache lines Source code reveals approximate position Search through remaining choices Once found, repeat observations timeslot timeslot Decryption Start First Secret Exponent (dp) Second Secret Exponent (dq) timeslot 25

25 Raw Traces

26 After Alignment timeslot

27 After Processing and Alignment Correct (red) vs recovered (blue): little remaining noise 28

28 Final key recovery? Distance to table initialization reveals multiplicand value d must be recovered from noisy d p and d q More details in: 29

29 Conclusion Co-Location Problem can be solved in Public Clouds Caches provide a powerful side channel in the Cloud Deduplication makes exploitation very simple Smart Prime+Probe works w/out Deduplication Key Recovery in Public Clouds is possible! Countermeasures still open problem: Many proposed, but cost overhead prohibitive? For Crypto Libraries: Recent patches of well-maintained libraries are secure 30

30 Thank you! vernam.wpi.edu