The following discussion is meant to facilitate the understanding of side-channel attacks that affect today’s modern multicore processors. Side-channel attacks leverage the side effects of the execution of code. In this discussion, I will cover channels available through shared hardware devices such as processors, hard disk controllers or shared physical memory. Specifically, our focus will be on side channels in the last-level shared cache of Intel CPUs.

Types of Side-Channel Attacks

There are several types of side-channel attacks. One type that has received popular coverage is based on a technique called differential power analysis. This technique is a statistical method through which a black-box analysis of an unknown cryptographic hardware device can be used to discover secrets and intermediate cryptographic values via their power consumption. However, there are several other side-channel attacks that rely upon some knowledge of the system under test.

This is not as limiting as it might seem. For example, microprocessor specifications are available through the Hardware Reference documentation available from most manufacturers. I will discuss these side-channel attacks, which exploit knowledge of the underlying architecture in order to leak secrets from a virtual machine (VM) located on a CPU to another VM located on that same CPU. Note that this does not mean the same core, but rather the same processor package.

This scenario often arises in cloud computing when physical resources are shared among customers, called tenants. The storage technique is common on clouds because it allows the provider to use its physical resources in the most efficient manner possible.

Infrastructure-as-a-Service Clouds and Others

Infrastructure-as-a-service (IaaS) clouds offer scalability of servers or other resources based upon the demand from the tenant. To respond to these demands, the cloud provider will launch VMs on its compute nodes, or physical computers. These VMs can either be on the same compute node or they could be geographically separated onto different compute nodes. In order to protect one tenant’s resources from another on the same compute node, cloud providers rely upon the virtual machine monitor (VMM), or hypervisor. The VMM is responsible for protecting each tenant from exposure, whether accidentally or intentionally, to other tenants on the same compute node. It is this logical isolation that would be defeated via side-channel attacks.

There are other types of clouds, as well. Platform-as-a-service (PaaS) clouds are generally Web servers or other hosted servers that allow users to share common binaries and environments. Everyone has access to the same software, and the isolation is generally performed through Linux containers rather than full VMs. They also share the same kernel, as well as all the write-protected shared memory pages, so that pages do not have to be duplicated from one container to the next. For example, they share the same libc for Unix. The PaaS attack uses a strike against the shared last-level CPU cache but exploits this deduplication.

Attacks Against Services

The attacks against IaaS clouds, which use VMs for isolation, are by necessity more complex because one must find shared resources across VMs. In these attacks, the shared resource will be the CPU’s last-level cache, which is shared across VMs as well as CPU cores. Note that while PaaS attacks also use this feature, attacks against IaaS must be more sophisticated.

The first attack against the IaaS clouds is the same attack used against PaaS clouds. But, as I will describe, it is much more complex in the IaaS case; in fact, it’s often impossible. PaaS attacks, on the other hand, makes this attack trivially simple when Linux containers are used.

The attacks below assume that there is at least one (but usually several) attacker VMs controlled by the adversary, and at least one (but usually more) target VMs belonging to the cloud tenant under attack. In order for the attacks to succeed, the adversary must have at least one VM located on the same compute node and physical CPU (not the same core, but the same processor package) as the target. Note that this has been demonstrated to be possible in 40 percent of the experimental trials conducted. In these trials, the experimenters used a covert channel to identify whether they were a co-resident on the same machine, but this could be done by means of OS fingerprinting, network probes and even the side channel itself by stimulating a behavior in a target and searching for telltale signs of the activity, such as timing variations in code execution.

Because of this, some commercial cloud providers are offering guarantees that one tenant will be allocated a set of resources to themselves, not shared by another tenant.

Once co-residency has been achieved between an attacker VM and a target VM, there are several side channels that may be employed by the attacker to obtain information from the target. The most successful have been based on the CPU’s cache. Multiple cores can complicate this attack since each core has its own cache. However, in Intel CPUs the cores share what is called the last-level cache (LLC). The LLC is much larger than the caches on the cores themselves. This complicates attacks, as does its slower speed.

Stay Tuned…

I will discuss three attacks aimed at multicore CPUs, which are finely grained enough to discover cryptographic secrets. Given this resolution, other secrets are certainly possible to obtain, but cryptographic secrets such as private keys are often the best protected and most sensitive secrets in the target VM. Once again, any secret on your cloud instance can be obtained if the conditions are right. These side-channel attacks can exploit any execution timings to obtain any secret that your cloud VM processes.

Find out how your secrets on the cloud could be leaked to an attacker in Parts II and III of this series. Part II reviews attacks against El Gamal and RSA encryption in more depth, while Part III covers the attack that can recover an AES key in two minutes.

More from Cloud Security

The Importance of Modern-Day Data Security Platforms

Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

Cybersecurity in the Next-Generation Space Age, Pt. 4: New Space Future Development and Challenges

View Part 1, Introduction to New Space, Part 2, Cybersecurity Threats in New Space, and Part 3, Securing the New Space, in this series. After the previous three parts of this series, we ascertain that the technological evolution of New Space ventures expanded the threats that targeted the space system components. These threats could be countered by various cybersecurity measures. However, the New Space has brought about a significant shift in the industry. This wave of innovation is reshaping the future…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

How Posture Management Prevents Catastrophic Cloud Breaches

We've all heard about catastrophic cloud breaches. But for every cyberattack reported in the news, many more may never reach the public eye. Perhaps worst of all, a large number of the offending vulnerabilities might have been avoided entirely through proper cloud configuration. Many big cloud security catastrophes often result from what appear to be tiny lapses. For example, the famous 2019 Capital One breach was traced to a misconfigured application firewall. Could a proper configuration have prevented that breach?…