MSc Thesis Presentation - Yayu Wang

Name:  Yayu Waag
Date:  December 2, 2024
Time:  2 pm - 3 pm
Location:   x836
Supervisor:  Aastha Mehta

Title:  Cache Side-Channel Attacks on Language Runtime Systems

Abstract:
Cache side-channel attacks are a class of attacks where an attacker co-located with a victim application on a server can infer the victim's secrets from observations of the victim's usage of shared caches on the server. Conventionally, cache side channels have been used to leak sensitive information from applications written in native languages (e.g., C) and compiled into binary. However, cache side-channel vulnerabilities in applications using language runtimes have received less attention.

Language runtimes introduce several barriers to performing cache side-channel attacks. First, with language runtimes, the application code is converted into a bytecode sequence, which is then interpreted as a sequence of machine instructions during execution. The attacker therefore needs to identify the cache lines that uniquely map to the sequence of machine instructions corresponding to specific bytecode operations in the victim's logic. Second, the control flow in runtime interpretation logic may influence the state of the cache which is shared between the attacker, the victim application, and the runtime. Consequently, the runtime induces the noise in the cache measurements that prevents the attacker from accurately inferring the victim's execution logic.
 
In this work, we address the above challenges and demonstrate that cache side-channel attacks can be exploited on applications executed with language runtimes. We present two well-known types of cache side-channel attacks, namely Prime+Scope and Flush+Reload, on a JavaScript implementation of RSA that is run on QuickJS. We show that even if the RSA source code is hardened to have secret-independent execution time, the secret key can be leaked via cache side-channel observations on RSA's bytecode interpretation with 96% accuracy after only 8 runs of the RSA.