Fantastic Timers and Where to Find Them: High-Resolution Microarchitectural Attacks in JavaScript

Transcription

1 Fantastic Timers and Where to Find Them: High-Resolution Microarchitectural Attacks in JavaScript Michael Schwarz, Clémentine Maurice, Daniel Gruss, Stefan Mangard Graz University of Technology April 2017 FC / 26

2 Outline Building a covert channel from a virtual machine without network access to the browser Reviving cache attacks in the browser No high-resolution timers in JavaScript How can we build our own timers? How to get a higher resolution than the native timers? 2 / 26

3 Covert channel What is a covert channel? Two programs would like to communicate 3 / 26

4 Covert channel What is a covert channel? Two programs would like to communicate but are not allowed to do so 3 / 26

5 Covert channel What is a covert channel? Two programs would like to communicate but are not allowed to do so either because there is no communication channel... 3 / 26

6 Covert channel What is a covert channel? Two programs would like to communicate but are not allowed to do so either because there is no communication channel......or the channels are monitored and programs are stopped on communication attempts 3 / 26

7 Covert channel What is a covert channel? Two programs would like to communicate but are not allowed to do so either because there is no communication channel......or the channels are monitored and programs are stopped on communication attempts Use side channels to communicate 3 / 26

8 DRAM organization 4 / 26

9 DRAM organization channel 0 channel 1 4 / 26

10 DRAM organization back of DIMM: rank 1 channel 0 front of DIMM: rank 0 channel 1 4 / 26

11 DRAM organization back of DIMM: rank 1 channel 0 channel 1 front of DIMM: rank 0 chip 4 / 26

12 DRAM organization chip bank 0 row 0 row 1 row 2... row row buffer 5 / 26

13 DRAM organization chip bank 0 row 0 row 1 row 2... row row buffer 64k cells 1 capacitor, 1 transitor each 5 / 26

14 The row buffer DRAM internally is only capable of reading entire rows 6 / 26

15 The row buffer DRAM internally is only capable of reading entire rows Capacitors in cells discharge when reading them Bits are buffered when reading them from the cells Then, bits are written back to the cells again 6 / 26

16 The row buffer DRAM internally is only capable of reading entire rows Capacitors in cells discharge when reading them Bits are buffered when reading them from the cells Then, bits are written back to the cells again Row buffer 6 / 26

17 Reading from DRAM DRAM bank CPU reads row 1, row buffer empty! row buffer 7 / 26

18 Reading from DRAM activate DRAM bank copy row buffer 7 / 26

19 Reading from DRAM DRAM bank return row buffer 7 / 26

20 Reading from DRAM DRAM bank CPU reads row 1, row buffer now full! row buffer 7 / 26

21 Reading from DRAM return DRAM bank Less work! Is it faster? row buffer 7 / 26

22 Timing difference Frequency Row hits Row misses Clock cycles Row hits ( 225 cycles) and row conflicts ( 247 cycles) 8 / 26

23 Timers in JavaScript We need a high-resolution timer to measure such small differences 9 / 26

24 Timers in JavaScript We need a high-resolution timer to measure such small differences Native: rdtsc - timestamp in CPU cycles 9 / 26

25 Timers in JavaScript We need a high-resolution timer to measure such small differences Native: rdtsc - timestamp in CPU cycles JavaScript: performance.now() has the highest resolution 9 / 26

26 Timers in JavaScript We need a high-resolution timer to measure such small differences Native: rdtsc - timestamp in CPU cycles JavaScript: performance.now() has the highest resolution performance.now() [...] represent times as floating-point numbers with up to microsecond precision. Mozilla Developer Network 9 / 26

27 to microsecond precision? Firefox / 26

28 to microsecond precision? Edge 38 1 Firefox / 26

29 to microsecond precision? W3C standard Edge 38 1 Firefox / 26

30 to microsecond precision? 0 0 Firefox 37/Chrome/Safari 5 W3C standard 5 Edge 38 1 Firefox / 26

31 to microsecond precision? 0 Tor 0 Firefox 37/Chrome/Safari 5 W3C standard 5 Edge 38 1 Firefox / 26

32 to microsecond precision? Fuzzyfox Tor Firefox 37/Chrome/Safari 5 W3C standard 5 Edge 38 1 Firefox / 26

33 We require a higher resolution Current precision is not sufficient to measure cycle differences 11 / 26

34 We require a higher resolution Current precision is not sufficient to measure cycle differences We have two possibilities 11 / 26

35 We require a higher resolution Current precision is not sufficient to measure cycle differences We have two possibilities Recover a higher resolution from the available timer 11 / 26

36 We require a higher resolution Current precision is not sufficient to measure cycle differences We have two possibilities Recover a higher resolution from the available timer Build our own high-resolution timer 11 / 26

37 Recovering resolution - Clock interpolation Measure how often we can increment a variable between two timer ticks 12 / 26

38 Recovering resolution - Clock interpolation Measure how often we can increment a variable between two timer ticks Average number of increments is the interpolation step 12 / 26

39 Recovering resolution - Clock interpolation Measure how often we can increment a variable between two timer ticks Average number of increments is the interpolation step To measure with high resolution: 12 / 26

40 Recovering resolution - Clock interpolation Measure how often we can increment a variable between two timer ticks Average number of increments is the interpolation step To measure with high resolution: Start measurement at clock edge 12 / 26

41 Recovering resolution - Clock interpolation Measure how often we can increment a variable between two timer ticks Average number of increments is the interpolation step To measure with high resolution: Start measurement at clock edge Increment a variable until next clock edge 12 / 26

42 Recovering resolution - Clock interpolation Measure how often we can increment a variable between two timer ticks Average number of increments is the interpolation step To measure with high resolution: Start measurement at clock edge Increment a variable until next clock edge Highly accurate: 500 ns (Firefox/Chrome), 15 µs (Tor) 12 / 26

43 Recovering resolution - Edge thresholding We can get a higher resolution for a classifier only 13 / 26

44 Recovering resolution - Edge thresholding We can get a higher resolution for a classifier only Often sufficient to see which of two functions takes longer 13 / 26

45 Recovering resolution - Edge thresholding We can get a higher resolution for a classifier only Often sufficient to see which of two functions takes longer f slow f fast 13 / 26

46 Recovering resolution - Edge thresholding We can get a higher resolution for a classifier only Often sufficient to see which of two functions takes longer f slow f fast Padding Padding Edge thresholding: apply padding such that the slow function crosses one more clock edge than the fast function. 13 / 26

47 Recovering resolution - Edge thresholding percentage unaligned aligned padded both correct f slow misclassified f fast misclassified 14 / 26

48 Recovering resolution - Edge thresholding percentage unaligned aligned padded both correct f slow misclassified f fast misclassified Yields nanosecond resolution 14 / 26

49 Recovering resolution - Edge thresholding percentage unaligned aligned padded both correct f slow misclassified f fast misclassified Yields nanosecond resolution Firefox/Tor (2 ns), Edge (10 ns), Chrome (15 ns) 14 / 26

50 Building a timer Goal: counter that does not block main thread 15 / 26

51 Building a timer Goal: counter that does not block main thread Baseline settimeout: 4 ms (except Edge: 2 ms) 15 / 26

52 Building a timer Goal: counter that does not block main thread Baseline settimeout: 4 ms (except Edge: 2 ms) CSS animation: increase width of element as fast as possible 15 / 26

53 Building a timer Goal: counter that does not block main thread Baseline settimeout: 4 ms (except Edge: 2 ms) CSS animation: increase width of element as fast as possible Width of element is timestamp 15 / 26

54 Building a timer Goal: counter that does not block main thread Baseline settimeout: 4 ms (except Edge: 2 ms) CSS animation: increase width of element as fast as possible Width of element is timestamp However, animation is limited to 60 fps 16 ms 15 / 26

55 Building a timer - Web worker JavaScript can spawn new threads called web worker 16 / 26

56 Building a timer - Web worker JavaScript can spawn new threads called web worker Web worker communicate using message passing 16 / 26

57 Building a timer - Web worker JavaScript can spawn new threads called web worker Web worker communicate using message passing Let worker count and request timestamp in main thread 16 / 26

58 Building a timer - Web worker JavaScript can spawn new threads called web worker Web worker communicate using message passing Let worker count and request timestamp in main thread Multiple possibilities: postmessage, MessageChannel or BroadcastChannel 16 / 26

59 Building a timer - Web worker JavaScript can spawn new threads called web worker Web worker communicate using message passing Let worker count and request timestamp in main thread Multiple possibilities: postmessage, MessageChannel or BroadcastChannel Yields microsecond resolution (even on Tor and Fuzzyfox) 16 / 26

60 Building a timer - Web worker Experimental feature to share data: SharedArrayBuffer 17 / 26

61 Building a timer - Web worker Experimental feature to share data: SharedArrayBuffer Web worker can simultaneously read/write data 17 / 26

62 Building a timer - Web worker Experimental feature to share data: SharedArrayBuffer Web worker can simultaneously read/write data No message passing overhead 17 / 26

63 Building a timer - Web worker Experimental feature to share data: SharedArrayBuffer Web worker can simultaneously read/write data No message passing overhead One dedicated worker for incrementing the shared variable 17 / 26

64 Building a timer - Web worker Experimental feature to share data: SharedArrayBuffer Web worker can simultaneously read/write data No message passing overhead One dedicated worker for incrementing the shared variable Firefox/Fuzzyfox: 2 ns, Chrome: 15 ns 17 / 26

65 Building a timer - Web worker Experimental feature to share data: SharedArrayBuffer Web worker can simultaneously read/write data No message passing overhead One dedicated worker for incrementing the shared variable Firefox/Fuzzyfox: 2 ns, Chrome: 15 ns Sufficient for microarchitectural attacks 17 / 26

66 Measuring cache timing Number of cases cache hit cache miss Access time [SharedArrayBuffer increments] 18 / 26

67 DRAM covert channel Sender and receiver agree on a bank (can be hardcoded) 19 / 26

68 DRAM covert channel Sender and receiver agree on a bank (can be hardcoded) Both (native) sender inside VM and JavaScript on host select a different row inside this bank 19 / 26

69 DRAM covert channel Sender and receiver agree on a bank (can be hardcoded) Both (native) sender inside VM and JavaScript on host select a different row inside this bank JavaScript measures access time for this row 19 / 26

70 DRAM covert channel Sender and receiver agree on a bank (can be hardcoded) Both (native) sender inside VM and JavaScript on host select a different row inside this bank JavaScript measures access time for this row Sender can transmit 0 by doing nothing and 1 by causing row conflict 19 / 26

71 DRAM covert channel Sender and receiver agree on a bank (can be hardcoded) Both (native) sender inside VM and JavaScript on host select a different row inside this bank JavaScript measures access time for this row Sender can transmit 0 by doing nothing and 1 by causing row conflict If measured timing was fast sender transmitted / 26

72 Transmitting data DRAM bank Sender and receiver decide on one bank row buffer 20 / 26

73 Transmitting data DRAM bank activate copy Receiver measures access time to its address row 0 0buffer / 26

74 Transmitting data DRAM bank return row 0 0buffer / 26

75 Transmitting data return DRAM bank Repeated access always has low access times row 0 0buffer / 26

76 Transmitting data DRAM bank return row 0 0buffer / 26

77 Transmitting data activate DRAM bank Sender accesses its address copy row 0 0buffer / 26

78 Transmitting data return DRAM bank Sender accesses its address row 0 0buffer / 26

79 Transmitting data DRAM bank activate On next access of receiver, there is a row miss copy row 0 0buffer / 26

80 Transmitting data return DRAM bank Receiver has high access time row 0 0buffer / 26

81 Measurement cycles /100 seconds Multiple measurements per bit to have a reliable detection 21 / 26

82 Measurement cycles /100 seconds Multiple measurements per bit to have a reliable detection 21 / 26

83 Sending packets Data EDC S e q Communication is based on packets 22 / 26

84 Sending packets Data EDC S e q Communication is based on packets Packet starts with a 2-bit preamble 22 / 26

85 Sending packets Data EDC S e q Communication is based on packets Packet starts with a 2-bit preamble Data integrity is checked by an error-detection code (EDC) 22 / 26

86 Sending packets Data EDC S e q Communication is based on packets Packet starts with a 2-bit preamble Data integrity is checked by an error-detection code (EDC) Sequence bit indicates whether it is a re-transmission or a new packet 22 / 26

87 Results Transmission of approximately 11 bits/s 23 / 26

88 Results Transmission of approximately 11 bits/s Can be improved using 23 / 26

89 Results Transmission of approximately 11 bits/s Can be improved using Fewer re-transmits 23 / 26

90 Results Transmission of approximately 11 bits/s Can be improved using Fewer re-transmits Error correction 23 / 26

91 Results Transmission of approximately 11 bits/s Can be improved using Fewer re-transmits Error correction Multithreading multiple banks in parallel 23 / 26

92 Results Transmission of approximately 11 bits/s Can be improved using Fewer re-transmits Error correction Multithreading multiple banks in parallel What is possible in native code? 596 kbit/s cross CPU and cross VM 23 / 26

93 Responsible disclosure We contacted Google, Mozilla, Microsoft and the Tor project 24 / 26

94 Responsible disclosure We contacted Google, Mozilla, Microsoft and the Tor project Microsoft no response 24 / 26

95 Responsible disclosure We contacted Google, Mozilla, Microsoft and the Tor project Microsoft no response Google several developers are assigned to the bug report 24 / 26

96 Responsible disclosure We contacted Google, Mozilla, Microsoft and the Tor project Microsoft no response Google several developers are assigned to the bug report Mozilla Discussing about clock randomization and not shipping SharedArrayBuffer 24 / 26

97 Responsible disclosure We contacted Google, Mozilla, Microsoft and the Tor project Microsoft no response Google several developers are assigned to the bug report Mozilla Discussing about clock randomization and not shipping SharedArrayBuffer Tor Working on fuzzy time 24 / 26

98 Conclusion Just rounding timers is not a solution 25 / 26

99 Conclusion Just rounding timers is not a solution Multithreading allows to build new timers 25 / 26

100 Conclusion Just rounding timers is not a solution Multithreading allows to build new timers Shared data comes with great risks 25 / 26

101 Conclusion Just rounding timers is not a solution Multithreading allows to build new timers Shared data comes with great risks It allows to build timers with nanosecond resolution 25 / 26

102 Conclusion Just rounding timers is not a solution Multithreading allows to build new timers Shared data comes with great risks It allows to build timers with nanosecond resolution Microarchitectural attacks in the browser are possible again 25 / 26

103 Michael Schwarz, Clémentine Maurice, Daniel Gruss, Stefan Mangard 26 / 26