Analysis and Detection of Cache-Based Exploits

Over the last decades the digitalization has become an integral part of daily life. Computer systems complexity has also grown at a rapid pace. New business models have emerged to optimize utilization and maintenance cost of these complex systems, but neglecting the introduction of new security threats. Cloud computing, for instance, has been established as an important part of the modern IT infrastructure ignoring the potential security risks entailed in its pervasive usage. A popular threat in the Cloud and other complex systems that are reliant on the usage of shared resources stems from the exploitation of side channels. In the context of co-location of mutually untrusted users on the same hardware, the confidentiality of user data has to be guaranteed. However, the class of side-channel and covert-channel attacks has been demonstrated to circumvent the secure isolation between co-located users both in the Cloud and in a native environment by exploiting hardware side effects, e.g., through timing analyses of accesses to CPU caches. The threat related to these exploits has been known for decades, but its relevance has grown with the increasing popularity of Cloud services. In this context, the cache is leveraged as an illegal channel to convey information either from one adversary to another in a covert-channel attack or to leak information from a victim to an attacker in a side-channel attack. As cache usage does not require any privileges, addressing the threat resulting from such an exploit turns out to be a challenging task. On this background, this thesis aims at enhancing systems security by considering the cache-based covert-channel and side-channel attacks. We develop a classification of existing attacks by exploring their feasibility depending on the execution environment context, and construct an information leakage model which includes the CPU scheduling effect on the core-private cache exploitability. To delve into the specifics of detecting cache exploits, we define a set of indicators of compromise and investigate their correlation with the success of a core-private cache exploit. To account for the effect of the hypervisor scheduling configuration on the exploitability of the core-private cache, we empirically assess the success of a covert-channel attack while varying hypervisor scheduling parameters. We employ software events and performance counters to develop a reliable detection mechanism tailored to find contemporary side-channel attacks. The results presented in the thesis demonstrate that by utilizing deliberately selected indicators of compromise along with a comprehensive analysis, systems security can be significantly enhanced with respect to the cache exploitability