- Reaction score
- 1,779
MIT CSAIL researchers found a way to exploit a split-second gap in chip security — and used it to acquire a Linux system’s password file.
Modern processors are fast, in part, because they guess. Rather than waiting to find out which way a program will branch, a chip predicts the likely path and races ahead. When the guess is right, time is saved. When it's wrong, the work is discarded, but traces of it linger. Since the Spectre vulnerability was disclosed in 2018, attackers have known how to read those traces to pull secrets out of memory they should never see.
Chipmakers and operating system developers have spent years building defenses. A new study from MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) shows that a key assumption behind many of them doesn't hold.
The defenses work by wiping or isolating the processor's prediction machinery, removing anything an attacker might have planted. The catch, as Daniël Trujillo, a PhD student in the MIT Department of Electrical Engineering and Computer Science (EECS), and Mengjia Yan, an assistant professor in EECS, point out, is that the wipe and the moment the predictions get used can't happen at the same instant. There is always a gap — sometimes only a handful of instructions wide. Anything that runs in that gap can dirty the machinery all over again. The researchers call this class of attack "TONTOU."
Their contribution is a reliable way to get code into that gap. Computers constantly pause whatever they're doing to handle interrupts: small, routine tasks triggered by timers, network traffic, and hardware. Ordinary programs can set those timers themselves. By tuning a timer with enough precision, Trujillo and Yan can make the processor take its detour at exactly the wrong moment, and the interrupt execution does the contaminating. They call the technique "interrupt injection."
news.mit.edu
Modern processors are fast, in part, because they guess. Rather than waiting to find out which way a program will branch, a chip predicts the likely path and races ahead. When the guess is right, time is saved. When it's wrong, the work is discarded, but traces of it linger. Since the Spectre vulnerability was disclosed in 2018, attackers have known how to read those traces to pull secrets out of memory they should never see.
Chipmakers and operating system developers have spent years building defenses. A new study from MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) shows that a key assumption behind many of them doesn't hold.
The defenses work by wiping or isolating the processor's prediction machinery, removing anything an attacker might have planted. The catch, as Daniël Trujillo, a PhD student in the MIT Department of Electrical Engineering and Computer Science (EECS), and Mengjia Yan, an assistant professor in EECS, point out, is that the wipe and the moment the predictions get used can't happen at the same instant. There is always a gap — sometimes only a handful of instructions wide. Anything that runs in that gap can dirty the machinery all over again. The researchers call this class of attack "TONTOU."
Their contribution is a reliable way to get code into that gap. Computers constantly pause whatever they're doing to handle interrupts: small, routine tasks triggered by timers, network traffic, and hardware. Ordinary programs can set those timers themselves. By tuning a timer with enough precision, Trujillo and Yan can make the processor take its detour at exactly the wrong moment, and the interrupt execution does the contaminating. They call the technique "interrupt injection."
New type of attack can slip past the defenses in your computer’s processor
MIT CSAIL researchers show how malicious actors can exploit a split-second gap in chip defenses, using the Interrupt Injection technique to steal a Linux system’s password file.
