论文标题
分层二进制模板：有效检测编译器和链接器引入的泄漏
Layered Binary Templating: Efficient Detection of Compiler- and Linker-introduced Leakage
论文作者
论文摘要
缓存模板攻击显示了共享库中用户输入的自动泄漏。但是，对于大型二进制文件，运行时非常高。其他自动化方法侧重于加密实现和媒体软件，但不直接适用于用户输入。因此，在巨大的代码库中发现并消除所有用户输入侧通道泄漏是不切实际的。 在本文中，我们提出了一种新的通用缓存模板攻击技术，LBTA，分层的二进制模板攻击。 LBTA使用多个粗粒侧通道层作为缓存线粒度模板的扩展，以加快缓存模板攻击的运行时。我们描述具有不同层的层层的LBTA，在实践中，从理论上讲，在实践中，范围从64 B到2MB。特别是软件级页面缓存侧通道与硬件级L3缓存侧通道结合使用，已经将模板运行时减少了三个数量级。我们将LBTA应用于不同的软件项目，从而在编译过程中发现数据重复数据删除和消失，并将其链接为新的安全问题。我们表明，这些机制引入了二进制文件中较大的空间距离，以供击键过程中访问的数据，从而可靠地泄漏了击键。在基于铬的应用程序上使用LBTA，我们可以构建一个完整的基于无特点的高速缓存的钥匙记录仪。我们的发现表明，所有对基于铬的应用程序的用户输入都受到影响，我们在诸如Passky之类的信号，Threema，Discord和Password Manager应用程序（包括Signal，Threema，Discord和Password Manager应用程序）中进行了选择。由于这不是单个应用程序的缺陷，而是框架的缺陷，我们得出结论，所有使用该框架的应用程序也将受到影响，即数百个应用程序。
Cache template attacks demonstrated automated leakage of user input in shared libraries. However, for large binaries, the runtime is prohibitively high. Other automated approaches focused on cryptographic implementations and media software but are not directly applicable to user input. Hence, discovering and eliminating all user input side-channel leakage on a cache-line granularity within huge code bases are impractical. In this paper, we present a new generic cache template attack technique, LBTA, layered binary templating attacks. LBTA uses multiple coarser-grained side channel layers as an extension to cache-line granularity templating to speed up the runtime of cache templating attacks. We describe LBTA with a variable number of layers with concrete side channels of different granularity, ranging from 64 B to 2MB in practice and in theory beyond. In particular the software-level page cache side channel in combination with the hardware-level L3 cache side channel, already reduces the templating runtime by three orders of magnitude. We apply LBTAs to different software projects and thereby discover data deduplication and dead-stripping during compilation and linking as novel security issues. We show that these mechanisms introduce large spatial distances in binaries for data accessed during a keystroke, enabling reliable leakage of keystrokes. Using LBTA on Chromium-based applications, we can build a full unprivileged cache-based keylogger. Our findings show that all user input to Chromium-based apps is affected and we demonstrate this on a selection of popular apps including Signal, Threema, Discord, and password manager apps like passky. As this is not a flaw of individual apps but the framework, we conclude that all apps that use the framework will also be affected, i.e., hundreds of apps.
