Skip to content

Skim Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems to see if it counts as a privacy-breaking side-channel #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
defuse opened this issue Jul 20, 2016 · 3 comments
Closed

Skim Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems to see if it counts as a privacy-breaking side-channel #55

defuse opened this issue Jul 20, 2016 · 3 comments
Milestone
Black Hat

Comments

@defuse
Copy link
Owner

defuse commented Jul 20, 2016

No description provided.

@defuse defuse added this to the Black Hat milestone Jul 20, 2016
@defuse
Copy link
Owner Author

defuse commented Jul 20, 2016

This is a really weird threat model: The OS is malicious, but the hypervisor and application running on the OS are not, and you want to defend the application from the OS.

@defuse
Copy link
Owner Author

defuse commented Jul 20, 2016

Holy shit this is cool, it uses page faults to monitor which pages of memory are being accessed over time. For example page-granularity view of code execution in FreeType leaks the characters, and they extract text contents that way. If that's possible, unless the code runes too fast, I'm betting it's possible to do this using Flush+Reload. Opened #60.

@defuse defuse mentioned this issue Jul 20, 2016
Open
@defuse
Copy link
Owner Author

defuse commented Jul 20, 2016

Done.

@defuse defuse closed this as completed Jul 20, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
Black Hat
Development

No branches or pull requests
1 participant
@defuse