ZombieLoad: Cross-privilege-boundary data sampling

M Schwarz, M Lipp, D Moghimi, J Van Bulck… - Proceedings of the …, 2019 - dl.acm.org
In early 2018, Meltdown first showed how to read arbitrary kernel memory from user space
by exploiting side-effects from transient instructions. While this attack has been mitigated …

Meltdown: Reading kernel memory from user space

M Lipp, M Schwarz, D Gruss, T Prescher… - Communications of the …, 2020 - dl.acm.org
Meltdown: reading kernel memory from user space Page 1 46 COMMUNICATIONS OF THE
ACM | JUNE 2020 | VOL. 63 | NO. 6 contributed articles IMA GE B Y ANDRIJ BOR YS A …

A systematic evaluation of transient execution attacks and defenses

C Canella, J Van Bulck, M Schwarz, M Lipp… - 28th USENIX Security …, 2019 - usenix.org
Research on transient execution attacks including Spectre and Meltdown showed that
exception or branch misprediction events might leave secret-dependent traces in the CPU's …

PLATYPUS: Software-based power side-channel attacks on x86

M Lipp, A Kogler, D Oswald, M Schwarz… - … IEEE Symposium on …, 2021 - ieeexplore.ieee.org
Power side-channel attacks exploit variations in power consumption to extract secrets from a
device, eg, cryptographic keys. Prior attacks typically required physical access to the target …

Fallout: Leaking data on meltdown-resistant cpus

C Canella, D Genkin, L Giner, D Gruss, M Lipp… - Proceedings of the …, 2019 - dl.acm.org
Meltdown and Spectre enable arbitrary data leakage from memory via various side
channels. Short-term software mitigations for Meltdown are only a temporary solution with a …

Meltdown

M Lipp, M Schwarz, D Gruss, T Prescher… - arxiv preprint arxiv …, 2018 - arxiv.org
The security of computer systems fundamentally relies on memory isolation, eg, kernel
address ranges are marked as non-accessible and are protected from user access. In this …

Translation leak-aside buffer: Defeating cache side-channel protections with {TLB} attacks

B Gras, K Razavi, H Bos, C Giuffrida - 27th USENIX Security Symposium …, 2018 - usenix.org
To stop side channel attacks on CPU caches that have allowed attackers to leak secret
information and break basic security mechanisms, the security community has developed a …

Malware guard extension: Using SGX to conceal cache attacks

M Schwarz, S Weiser, D Gruss, C Maurice… - Detection of Intrusions …, 2017 - Springer
In modern computer systems, user processes are isolated from each other by the operating
system and the hardware. Additionally, in a cloud scenario it is crucial that the hypervisor …

Survey of CPU Cache‐Based Side‐Channel Attacks: Systematic Analysis, Security Models, and Countermeasures

C Su, Q Zeng - Security and Communication Networks, 2021 - Wiley Online Library
Privacy protection is an essential part of information security. The use of shared resources
demands more privacy and security protection, especially in cloud computing environments …

{ScatterCache}: thwarting cache attacks via cache set randomization

M Werner, T Unterluggauer, L Giner… - 28th USENIX Security …, 2019 - usenix.org
Cache side-channel attacks can be leveraged as a building block in attacks leaking secrets
even in the absence of software bugs. Currently, there are no practical and generic …