一句话：提出微体系结构怪异机器 µWM，利用分支预测器和缓存等冲突的时序副作用执行任意计算，并用于隐蔽混淆恶意代码。
Spectre 等侧信道攻击表明，现代 CPU 的微架构状态可通过操作时序探测。Weird Machine 模型用于刻画由常规计算副作用涌现出的执行。本文提出微体系结构怪异机器（µWM）：通过制造分支预测器、缓存等微架构实体间的冲突与副作用来执行计算，并以时序变化观察结果，从而形成一种对模拟、调试及静态/动态分析工具不可见的混淆引擎。作者实现 SHA-1 哈希函数，证明 µWM 可可靠完成任意计算；并展示其实际滥用：将恶意代码的被动阶段隐藏在系统架构状态完全可见时仍不可察觉，收到触发后解密并执行载荷。评估中隐藏并执行了窃取 shadow 密码文件和创建反向 shell 的载荷，验证了混淆效果。
Side-channel attacks such as Spectre rely on properties of modern CPUs that permit discovery of microarchitectural state via timing of various operations. The Weird Machine concept is an increasingly popular model for characterization of emergent execution that arises from side-effects of conventional computing constructs. In this work we introduce Microarchitectural Weird Machines (µWM): code constructions that allow performing computation through the means of side effects and conflicts between microarchitectual entities such as branch predictors and caches. The results of such computations are observed as timing variations. We demonstrate how µWMs can be used as a powerful obfuscation engine where computation operates based on events unobservable to conventional anti-obfuscation tools based on emulation, debugging, static and dynamic analysis techniques. We demonstrate that µWMs can be used to reliably perform arbitrary computation by implementing a SHA-1 hash function. We then present a practical example in which we use a µWM to obfuscate malware code such that its passive operation is invisible to an observer with full power to view the architectural state of the system until the code receives a trigger. When the trigger is received the malware decrypts and executes its payload. To show the effectiveness of obfuscation we demonstrate its use in the concealment and subsequent execution of a payload that exfiltrates a shadow password file, and a payload that creates a reverse shell.
DOI 原文 ·
@inproceedings{paperbot6114,
title = {Computing with time: microarchitectural weird machines},
author = {Dmitry Evtyushkin and Thomas Benjamin and Jesse Elwell and Jeffrey A. Eitel and Angelo Sapello and Abhrajit Ghosh},
booktitle = {ASPLOS},
year = {2021},
doi = {10.1145/3445814.3446729}
}