一句话：展示公有 FaaS 云中端到端跨租户末级缓存侧信道攻击可行，可窃取 ECDSA nonce 秘密位。
末级缓存侧信道攻击此前多在高可控本地环境验证，其在生产公有云中的可行性尚不明确；云中租户噪声大，FaaS 攻击窗口极短。本文在 Google Cloud Run 公有 FaaS 环境对易受攻击的 ECDSA 实现实施端到端跨租户攻击。作者提出 L2 驱动的候选地址过滤与二分搜索地址剪枝加速驱逐集生成，使用 Parallel Probing 高时间分辨率监视受害者内存访问，并利用功率谱密度在频域识别目标缓存组。评估显示，平均 19 秒可提取受害者容器中位数 81% 的 ECDSA nonce 秘密位。
Last-level cache side-channel attacks have been mostly demonstrated in highly-controlled, quiescent local environments. Hence, it is unclear whether such attacks are feasible in a production cloud environment. In the cloud, side channels are flooded with noise from activities of other tenants and, in Function-as-a-Service (FaaS) workloads, the attacker has a very limited time window to mount the attack. In this paper, we show that such attacks are feasible in practice, although they require new techniques. We present an end-to-end, cross-tenant attack on a vulnerable ECDSA implementation in the public FaaS Google Cloud Run environment. We introduce several new techniques to improve every step of the attack. First, to speed-up the generation of eviction sets, we introduce L2-driven candidate address filtering and a Binary Search-based algorithm for address pruning. Second, to monitor victim memory accesses with high time resolution, we introduce Parallel Probing. Finally, we leverage power spectral density from signal processing to easily identify the victim's target cache set in the frequency domain. Overall, using these mechanisms, we extract a median value of 81% of the secret ECDSA nonce bits from a victim container in 19 seconds on average.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{Zhao0FT24a,
title = {Last-Level Cache Side-Channel Attacks Are Feasible in the Modern Public Cloud},
author = {Zirui Neil Zhao and Adam Morrison and Christopher W. Fletcher and Josep Torrellas},
booktitle = {ASPLOS},
year = {2024},
doi = {10.1145/3620665.3640403}
}