FaultMorse: An automated controlled-channel attack via longest recurring sequence. Issue 124 (January 2023)

• Record Type: Journal Article
• Authors: Hu, Lifeng; Zhang, Fan; Liang, Ziyuan; Ding, Ruyi; Cai, Xingyu; Wang, Zonghui; Jin, Wenguang
• Is Part Of: Computers & security. Issue 124(2023)
• Publication Date: 2023-01
• Subjects: Controlled-channel -- Intel SGX -- Operating system -- Page fault -- Automation; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.103003
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: With the rise of the concept of Trusted Execution Environments (TEEs), such as Intel Software Guard Extensions (SGX), researchers are prompted to constantly verify its effectiveness. Controlled-channel attacks are proposed to construct side channels against the shielding systems by intentionally provoking page faults. So far, various powerful and noise-free controlled-channel attacks have been introduced. However, there are some challenges encountered in the actual practice of these attacks, e.g., extensive manual effort is always required to analyze the target binary and identify conditional control-flow patterns. In this paper, we present FaultMorse, an automated controlled-channel attack. We adopt a global perspective to analyze the page fault sequence and find a specific recurring pattern that corresponds to some specific instructions in the program. Most of the secret bits can be automatically deduced by analyzing the locations of the recurring pattern in the page fault sequence. Compared to previous works, FaultMorse can reduce the complexity of analysis. We propose a method to control page fault counts to improve the attack performance. We implement our FaultMorse attack on a physical machine and evaluate its effectiveness, universality, and page-fault rate. The experimental results show that for some known vulnerable algorithms, FaultMorse can automatically deduce more than 99% of the secret bits.