Hertzbleed: Turning power {Side-Channel} attacks into remote timing attacks on x86

Y Wang, R Paccagnella, ET He, H Shacham… - 31st USENIX Security …, 2022 - usenix.org
Power side-channel attacks exploit data-dependent variations in a CPU's power
consumption to leak secrets. In this paper, we show that on modern Intel (and AMD) x86 …

Foreshadow: Extracting the keys to the intel {SGX} kingdom with transient {Out-of-Order} execution

J Van Bulck, M Minkin, O Weisse, D Genkin… - 27th USENIX Security …, 2018 - usenix.org
Trusted execution environments, and particularly the Software Guard eXtensions (SGX)
included in recent Intel x86 processors, gained significant traction in recent years. A long …

ZombieLoad: Cross-privilege-boundary data sampling

M Schwarz, M Lipp, D Moghimi, J Van Bulck… - Proceedings of the …, 2019 - dl.acm.org
In early 2018, Meltdown first showed how to read arbitrary kernel memory from user space
by exploiting side-effects from transient instructions. While this attack has been mitigated …

Spectre attacks: Exploiting speculative execution

P Kocher, J Horn, A Fogh, D Genkin, D Gruss… - Communications of the …, 2020 - dl.acm.org
Modern processors use branch prediction and speculative execution to maximize
performance. For example, if the destination of a branch depends on a memory value that is …

Meltdown: Reading kernel memory from user space

M Lipp, M Schwarz, D Gruss, T Prescher… - Communications of the …, 2020 - dl.acm.org
Meltdown: reading kernel memory from user space Page 1 46 COMMUNICATIONS OF THE
ACM | JUNE 2020 | VOL. 63 | NO. 6 contributed articles IMA GE B Y ANDRIJ BOR YS A …

PLATYPUS: Software-based power side-channel attacks on x86

M Lipp, A Kogler, D Oswald, M Schwarz… - … IEEE Symposium on …, 2021 - ieeexplore.ieee.org
Power side-channel attacks exploit variations in power consumption to extract secrets from a
device, eg, cryptographic keys. Prior attacks typically required physical access to the target …

A systematic evaluation of transient execution attacks and defenses

C Canella, J Van Bulck, M Schwarz, M Lipp… - 28th USENIX Security …, 2019 - usenix.org
Research on transient execution attacks including Spectre and Meltdown showed that
exception or branch misprediction events might leave secret-dependent traces in the CPU's …

Meltdown

M Lipp, M Schwarz, D Gruss, T Prescher… - arxiv preprint arxiv …, 2018 - arxiv.org
The security of computer systems fundamentally relies on memory isolation, eg, kernel
address ranges are marked as non-accessible and are protected from user access. In this …

Spectre returns! speculation attacks using the return stack buffer

EM Koruyeh, KN Khasawneh, C Song… - 12th USENIX Workshop …, 2018 - usenix.org
The recent Spectre attacks exploit speculative execution, a pervasively used feature of
modern microprocessors, to allow the exfiltration of sensitive data across protection …

Fallout: Leaking data on meltdown-resistant cpus

C Canella, D Genkin, L Giner, D Gruss, M Lipp… - Proceedings of the …, 2019 - dl.acm.org
Meltdown and Spectre enable arbitrary data leakage from memory via various side
channels. Short-term software mitigations for Meltdown are only a temporary solution with a …