Exploiting Out-of-Order Execution for Covert Cross-VM Communication

Presented at Black Hat USA 2015, Aug. 6, 2015, 5 p.m. (25 minutes).

This presentation will demonstrate a novel side channel exploiting CPU out-of-order-execution to enable covert cross-VM communication in cloud computing environments. Live demonstrations will show several applications of this side channel, including cross process or VM eavesdropping, malware command & control and environmental keying. The presentation will conclude with a brief analysis of detection and mitigation techniques for this attack.

Presenters:

• Sophia d'Antoine - Trail of Bits   as Sophia D'Antoine
  Sophia D'Antoine is a security researcher at Trail of Bits and a student at Rensselaer Polytechnic Institute. At RPI, her graduate research focuses on malicious applications of hardware side channels in virtualized environments. Through her involvement in RPISEC, she has taught security courses (Modern Binary Exploitation) and competed in CTFs.

Links:

• https://www.blackhat.com/us-15/briefings.html#exploiting-out-of-order-execution-for-covert-cross-vm-communication
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2015/video/Black Hat USA 2015 - Exploiting Out of Order Execution For Covert Cross VM Communication.srt (subtitles)
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2015/video/Black Hat USA 2015 - Exploiting Out of Order Execution For Covert Cross VM Communication.mp4
• https://www.youtube.com/watch?v=SjcKqVRjNHc
• https://www.blackhat.com/docs/us-15/materials/us-15-DAntoine-Exploiting-Out-Of-Order-Execution-For-Covert-Cross-VM-Communication.pdf
• https://www.blackhat.com/docs/us-15/materials/us-15-DAntoine-Exploiting-Out-Of-Order-Execution-For-Covert-Cross-VM-Communication-wp.pdf

Similar Presentations:

• DEF CON 23 (2015) / Inter-VM data exfiltration: The art of cache timing covert channel on x86 multi-core
• REcon 2015 / Exploiting Out-of-Order-Execution: Processor Side Channels to Enable Cross VM Code Execution
• DeepSec 2017 „Science First!“ / Out-Of-Order Execution As A Cross-VM Side Channel And Other Applications