Presented at
Black Hat Europe 2017,
Dec. 6, 2017, 11:45 a.m.
(60 minutes).
The need for power and energy-efficient computing has resulted in aggressive cooperative hardware-software energy management mechanisms on modern commodity devices. Most systems today, for example, allow software to control the frequency and voltage of the underlying hardware at a very fine granularity to extend battery life. Despite their benefits, these software-exposed energy management mechanisms pose grave security implications that have not been studied before.
In this talk, we present the CLKSCREW attack, a new class of software-based fault attacks that exploit the security-obliviousness of energy management mechanisms to break security. A novel benefit for the attackers is that these fault attacks become more accessible since they can now be conducted without the need for physical access to the devices or fault injection equipment. We demonstrate CLKSCREW on commodity ARM/Android devices. We show that a malicious kernel driver (1) can extract secret cryptographic keys from Trustzone, and (2) can escalate its privileges by loading self-signed code into Trustzone. As the first work to show the security ramifications of energy management mechanisms, we urge the community to re-examine these security-oblivious designs.
Presenters:
-
Adrian Tang
- PhD Candidate, Columbia University
Adrian Tang is a Ph.D. candidate in the Intrusion Detection Systems (IDS) Lab, and the Computer Architecture and Security Technologies Lab (CASTL) in Columbia University. He is broadly interested in all aspects of systems and software security. Exploring security as a full-system property, his research examines both attack and defensive security techniques at the hardware-software interfaces of commodity systems. He is also an enthusiast in binary-level reverse engineering and malware analysis.
-
Salvatore Stolfo
- Professor, Columbia University
Salvatore Stolfo is a Professor of Computer Science at Columbia University. He is regarded as creating the area of machine learning applied to computer security in the mid-1990's and has created several anomaly detection algorithms and systems addressing some of the hardest problems in securing computer systems. Stolfo has had numerous best papers and awards. He has published well over 230 papers and has been granted over 60 patents and has been an advisor and consultant to government agencies, including DARPA, the National Academies and others, for well over 2 decades. Two security companies were recently spun out of his IDS lab, Allure Security Technology and Red Balloon Security.
-
Simha Sethumadhavan
- Professor, Columbia University
Prof. Simha Sethumadhavan's research is focused on finding practical solutions to problems in area of cybersecurity. Prof. Sethumadhavan is best known for his "hardware-up" principle for designing secure systems, which roughly speaking states that security systems should be designed like hardware systems, and should have an hardware component. This principle guides design of computer and cyber-physical systems when security is a first order design requirement: it teaches how foundations for security and trust can be built into hardware.
Simha Sethumadhavan received a Ph.D. in Computer Science from The University of Texas at Austin in 2007. Prof. Sethumadhavan is a recipient of an Alfred P. Sloan Research Fellowship, the NSF CAREER award and a IBM co-operative research award. He has received six best paper awards in computer security and computer architecture. His teams work on identifying security vulnerabilities resulted in fixes to major products such as mobile phone processors and web browsers used by millions of users, and his work on hardware security is actively considered by standards organizations. He has served on the Federal Communications Commission
Downloadable Security Technical Advisory Committee. He is the founder of Chip Scan Inc. a company that specializes in technology for producing trustworthy hardware.
Links:
Similar Presentations: