论文标题
DF-SCA：动态频率侧通道攻击是实用的
DF-SCA: Dynamic Frequency Side Channel Attacks are Practical
论文作者
论文摘要
在过去的十年中，硬件安全工程师和侧渠道研究人员之间的ARM比赛已经变得更有竞争力。尽管现代硬件功能可显着提高系统性能，但它们可能会为恶意人员创建新的攻击表面，以提取有关用户的敏感信息，而无需物理访问受害者设备。尽管许多先前被利用的硬件和操作系统功能都是由操作系统开发人员和芯片供应商修补的，但可以利用从用户空间应用程序访问的任何功能来执行基于软件的侧渠道攻击。 在本文中，我们提出了DF-SCA，这是对Linux和Android OS设备的基于软件的动态频率侧通道攻击。我们利用了对CPUFREQ接口的无私人访问，该接口揭示了与系统利用率直接相关的实时CPU核心频率值，从而为攻击者创建可靠的侧渠道。我们表明，现代系统中的动态电压和频率缩放（DVF）功能可用于对Google Chrome进行网站指纹攻击，并在现代Intel，AMD和ARM Architectures上进行TOR浏览器。我们进一步将分析扩展到了Intel和AMD CPU的各种规模的州长，并验证了所有扩展调查员在访问的网页上提供了足够的信息。此外，我们在频率读数上提取击键模式的性能，这将导致95％的准确性，以将击键与Android手机上的其他活动区分开。我们通过训练一个k-th最近的邻居模型来利用用户的尾部互动时间，该模型在美国银行应用程序的第一个猜测中达到了88％的密码恢复率。最后，我们提出了几种对策，以掩盖用户活动，以减轻基于Linux的系统的DF-SCA。
The arm race between hardware security engineers and side-channel researchers has become more competitive with more sophisticated attacks and defenses in the last decade. While modern hardware features improve the system performance significantly, they may create new attack surfaces for malicious people to extract sensitive information about users without physical access to the victim device. Although many previously exploited hardware and OS features were patched by OS developers and chip vendors, any feature that is accessible from userspace applications can be exploited to perform software-based side-channel attacks. In this paper, we present DF-SCA, which is a software-based dynamic frequency side-channel attack on Linux and Android OS devices. We exploit unprivileged access to cpufreq interface that exposes real-time CPU core frequency values directly correlated with the system utilization, creating a reliable side-channel for attackers. We show that Dynamic Voltage and Frequency Scaling (DVFS) feature in modern systems can be utilized to perform website fingerprinting attacks for Google Chrome and Tor browsers on modern Intel, AMD, and ARM architectures. We further extend our analysis to a wide selection of scaling governors on Intel and AMD CPUs, verifying that all scaling governors provide enough information on the visited web page. Moreover, we extract properties of keystroke patterns on frequency readings, that leads to 95% accuracy to distinguish the keystrokes from other activities on Android phones. We leverage inter-keystroke timings of a user by training a k-th nearest neighbor model, which achieves 88% password recovery rate in the first guess on Bank of America application. Finally, we propose several countermeasures to mask the user activity to mitigate DF-SCA on Linux-based systems.
