Ultimate {SLH}: Taking speculative load hardening to the next level

Z Zhang, G Barthe, C Chuengsatiansup… - 32nd USENIX Security …, 2023 - usenix.org
In this paper we revisit the Spectre v1 vulnerability and software-only countermeasures.
Specifically, we systematically investigate the performance penalty and security properties of …

iLeakage: Browser-based timerless speculative execution attacks on Apple devices

J Kim, S van Schaik, D Genkin, Y Yarom - Proceedings of the 2023 ACM …, 2023 - dl.acm.org
Over the past few years, the high-end CPU market is undergoing a transformational change.
Moving away from using x86 as the sole architecture for high performance devices, we have …

The gates of time: Improving cache attacks with transient execution

D Katzman, W Kosasih, C Chuengsatiansup… - 32nd USENIX Security …, 2023 - usenix.org
For over two decades, cache attacks have been shown to pose a significant risk to the
security of computer systems. In particular, a large number of works show that cache attacks …

The double edged sword: identifying authentication pages and their fingerprinting behavior

A Senol, A Ukani, D Cutler, I Bilogrevic - Proceedings of the ACM Web …, 2024 - dl.acm.org
Browser fingerprinting is often associated with cross-site user tracking, a practice that many
browsers (eg, Safari, Brave, Edge, Firefox, and Chrome) want to block. However, less is …

Robust and scalable process isolation against spectre in the cloud

M Schwarzl, P Borrello, A Kogler, K Varda… - … on Research in …, 2022 - Springer
In the quest for efficiency and performance, edge-computing providers replace process
isolation with sandboxes, to support a high number of tenants per machine. While secure …

ShowTime: Amplifying arbitrary CPU timing side channels

A Purnal, M Bognar, F Piessens… - Proceedings of the 2023 …, 2023 - dl.acm.org
Microarchitectural attacks typically rely on precise timing sources to uncover short-lived
secret-dependent activity in the processor. In response, many browsers and even CPU …

Uncontained: Uncovering container confusion in the linux kernel

J Koschel, P Borrello, DC D'Elia, H Bos… - 32nd USENIX Security …, 2023 - usenix.org
Type confusion bugs are a common source of security problems whenever software makes
use of type hierarchies, as an inadvertent downcast to an incompatible type is hard to detect …

Sysbumps: Exploiting speculative execution in system calls for breaking kaslr in macos for apple silicon

H Jang, T Kim, Y Shin - Proceedings of the 2024 on ACM SIGSAC …, 2024 - dl.acm.org
Apple silicon is the proprietary ARM-based processor that powers the mainstream of Apple
devices. The move to this proprietary architecture presents unique challenges in addressing …

TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution

J Kim, J Park, S Roh, J Chung, Y Lee, T Kim… - arxiv preprint arxiv …, 2024 - arxiv.org
ARM Memory Tagging Extension (MTE) is a new hardware feature introduced in ARMv8. 5-
A architecture, aiming to detect memory corruption vulnerabilities. The low overhead of MTE …

Sok: Can we really detect cache side-channel attacks by monitoring performance counters?

W Kosasih, Y Feng, C Chuengsatiansup… - Proceedings of the 19th …, 2024 - dl.acm.org
Sharing microarchitectural components between co-resident programs leads to potential
information leaks, with devastating implications on security. Over the last decade, multiple …