The Spy in the Sandbox -- Practical Cache Attacks in Javascript (1502.07373v2)

Abstract: We present the first micro-architectural side-channel attack which runs entirely in the browser. In contrast to other works in this genre, this attack does not require the attacker to install any software on the victim's machine -- to facilitate the attack, the victim needs only to browse to an untrusted webpage with attacker-controlled content. This makes the attack model highly scalable and extremely relevant and practical to today's web, especially since most desktop browsers currently accessing the Internet are vulnerable to this attack. Our attack, which is an extension of the last-level cache attacks of Yarom et al., allows a remote adversary recover information belonging to other processes, other users and even other virtual machines running on the same physical host as the victim web browser. We describe the fundamentals behind our attack, evaluate its performance using a high bandwidth covert channel and finally use it to construct a system-wide mouse/network activity logger. Defending against this attack is possible, but the required countermeasures can exact an impractical cost on other benign uses of the web browser and of the computer.

• The paper demonstrates a novel method to execute PRIME+PROBE cache attacks solely via JavaScript without installing malware.
• It details a robust evict-and-probe methodology leveraging fine-grained eviction set construction and system profiling to achieve covert channels at hundreds of kilobits per second.
• The findings highlight critical security implications, urging enhanced side-channel defenses in web browsers and shared cloud environments.

An Analysis of "The Spy in the Sandbox – Practical Cache Attacks in Javascript"

The paper "The Spy in the Sandbox – Practical Cache Attacks in Javascript" by Yossef Oren et al. presents an unprecedented paper of micro-architectural side-channel attacks conducted entirely within a web browser using JavaScript. This attack strategy deviates significantly from previous models as it does not necessitate the installation of malicious software on a victim's machine. Instead, simply accessing an attacker-controlled webpage suffices for launching the attack. This innovation renders the attack model highly scalable and applicable to a multitude of systems connected to the internet.

Technical Overview

The attack builds on the principles of last-level cache (LLC) attacks, particularly the PRIME+PROBE attack method, allowing a remote adversary to glean information from processes running on shared physical resources. This is particularly significant in environments such as cloud platforms where virtual machines share physical host hardware. The paper meticulously details the construction of a high-bandwidth covert channel, achieving a data transmission rate of hundreds of kilobits per second—comparable to native code techniques.

Key Components of the Attack:

• Eviction Set Construction: The paper introduces a novel approach to create eviction sets without requiring large page support, broadening its applicability. The authors leverage the structure of Intel's cache micro-architecture to map virtual to physical memory addresses effectively, overcoming the limitations imposed by JavaScript's restricted capabilities.
• System Profiling: Through detailed cache access pattern analysis, the attack can accurately infer system activities, including different user behaviors such as mouse movements and network activity.
• Covert Channel Implementation: Utilizing JavaScript, the authors demonstrate the use of the LLC to establish a covert channel that can silently exfiltrate data from a victim's machine.

Evaluation and Implications

The paper quantifies the attack's efficacy through experiments on several Intel CPU families, indicating the presence of the vulnerability across many modern systems. Despite the use of JavaScript's high-resolution timer posing a potential constraint, the paper adapts the method to accommodate temporal resolution variations, underscoring the robustness of the attack.

Implications:

• Threat Landscape Expansion: The demonstrated attack expands the threat landscape to include nearly any device running a modern browser, highlighting a need for side-channel resistant system designs.
• Security Considerations: This research underscores significant security considerations for browser developers, suggesting potential countermeasures like adjusting timing APIs or implementing heuristic detection of anomalous memory access patterns.

Future Directions

Future research could explore enhancing countermeasures by redesigning cache architectures to mitigate side-channel vulnerabilities. Additionally, further work may refine detection algorithms to identify and respond to suspicious cache access sequences dynamically. Given the ubiquitous nature of web browsers, addressing such vulnerabilities holistically across software and hardware domains remains crucial.

In conclusion, this paper provides a comprehensive exploration of the ingenuity and seriousness of web-based micro-architectural attacks, urging the research community and industry stakeholders to prioritize side-channel defense mechanisms in future system architectures.