Detection Technique of Software-induced Rowhammer Attacks

Dynamic Random Access Memory (DRAM) is widely used for data storage and, when a computer system is in operation, the DRAM can contain sensitive information such as passwords and cryptographic keys. Therefore, the DRAM is a prime target for hardware-based cryptanalytic attacks. These attacks can be performed in the supply chain to capture default key mechanisms enabling a later cyber attack or predisposition the system to remote effects. Two prominent attack classes against memory are the Cold Boot attack which recovers the data from the DRAM even after a supposed power-down and Rowhammer attack which violates memory integrity by influencing the stored bits to flip. In this paper, we propose an on-chip technique that obfuscates the memory addresses and data and provides a fast detect-response to defend against these hardware-based security attacks on DRAM. We advance the prior hardware security research by making two contributions. First, the key material is detected and erased before the Cold Boot attacker can extract the memory data. Second, our solution is on-chip and does not require nor depend on additional hardware or software which are open to additional supply chain attack vectors. We analyze the efficacy of our scheme through circuit simulation and compare the results to the previous mitigation approaches based on DRAM write operations. Our simulation and analysis results show that purging key information used for address and data randomization can be achieved much faster and with lower power than with typical DRAM write techniques used for sanitizing memory content. We demonstrate through circuit simulation of the key register design a technique that clears key information within 2.4ns which is faster by more than two orders magnitude compared to typical DRAM write operations for 180nm technology, and with a power consumption of 0.15 picoWatts.

This paper provides an end-to-end solution to defend against known microarchitectural attacks such as speculative execution attacks, fault-injection attacks, covert and side channel attacks, and unknown or evasive versions of these attacks. Current defenses are attack specific and can have unacceptably high performance overhead. We propose an approach that reduces the overhead of state-of-art defenses by over 95%, by applying defenses only when attacks are detected. Many current proposed mitigations are not practical for deployment; for example, InvisiSpec has 27% overhead and Fencing has 74% overhead while protecting against only Spectre attacks. Other mitigations carry similar performance penalties. We reduce the overhead for InvisiSpec to 1.26% and for Fencing to 3.45% offering performance and security for not only spectre attacks but other known transient attacks as well, including the dangerous class of LVI and Rowhammer attacks, as well as covering a large set of future evasive and zero-day attacks. Critical to our approach is an accurate detector that is not fooled by evasive attacks and that can generalize to novel zero-day attacks. We use a novel Generative framework, Evasion Vaccination (EVAX) for training ML models and engineering new security-centric performance counters. EVAX significantly increases sensitivity to detect and classify attacks in time for mitigation to be deployed with low false positives (4 FPs in every 1M instructions in our experiments). Such performance enables efficient and timely mitigations, enabling the processor to automatically switch between performance and security as needed.

The rowhammer vulnerability, where repeated accesses to a DRAM row can speed the discharge of neighboring bits, has emerged as a significant security concern in the computing industry. To address the problem, computer and software vendors have: i) doubled DRAM refresh rates, ii) restricted access to virtual-to-physical page mappings, and iii) disabled access to cache-flush operations in sandboxed environments. While recent efforts have shown how to overcome each of these protections individually, machines today are protected from rowhammer attacks if they employ all three of these protections simultaneously. In this paper, we demonstrate the first rowhammer attack that overcomes all three of these protections when used in tandem. Our attack is a virtual-memory based cache-flush free attack that is sufficiently fast to rowhammer with double rate refresh. The most astonishing aspect of our attack is that it is enabled by the recently introduced Cache Allocation Technology, a mechanism designed in part to protect virtual machines from inter-VM denial-of-service attacks. The subtext of this paper asks the question: “Is there any hope for system security, when the protections for one attack enable yet another?” We claim that the solution to this conundrum lies in the approach taken to protecting systems. Adopting a subtractive approach to secure systems, in contrast to additive measures, could go a long way toward building provably secure systems.

Post-quantum schemes are expected to replace existing public-key schemes within a decade in billions of devices. To facilitate the transition, the US National Institute for Standards and Technology (NIST) is running a standardization process. Multivariate signatures is one of the main categories in NIST's post-quantum cryptography competition. Among the four candidates in this category, the LUOV and Rainbow schemes are based on the Oil and Vinegar scheme, first introduced in 1997 which has withstood over two decades of cryptanalysis. Beyond mathematical security and efficiency, security against side-channel attacks is a major concern in the competition. The current sentiment is that post-quantum schemes may be more resistant to fault-injection attacks due to their large key sizes and the lack of algebraic structure. We show that this is not true. We introduce a novel hybrid attack, QuantumHammer, and demonstrate it on the constant-time implementation of LUOV currently in Round 2 of the NIST post-quantum competition. The QuantumHammer attack is a combination of two attacks, a bit-tracing attack enabled via Rowhammer fault injection and a divide and conquer attack that uses bit-tracing as an oracle. Using bit-tracing, an attacker with access to faulty signatures collected using Rowhammer attack, can recover secret key bits albeit slowly. We employ a divide and conquer attack which exploits the structure in the key generation part of LUOV and solves the system of equations for the secret key more efficiently with few key bits recovered via bit-tracing. We have demonstrated the first successful in-the-wild attack on LUOV recovering all 11K key bits with less than 4 hours of an active Rowhammer attack. The post-processing part is highly parallel and thus can be trivially sped up using modest resources. QuantumHammer does not make any unrealistic assumptions, only requires software co-location (no physical access), and therefore can be used to target shared cloud servers or in other sandboxed environments.

As most mobile devices are capable of accessing the Internet with a mobile web browser, the performance of mobile web browsers has become an interesting research topic recently. Due to network bandwidth and processing power limitations, mobile web browsers are slower compared to PC web browsers when dealing with large-size web contents and computation-intensive operations. In order to improve the performance of web browsers, researchers have attempted different techniques, including parallel optimization, web page prefetching, speculative loading, etc. With the introduction of mobile cloud computing, the performance of mobile devices can be augmented with the capability of the cloud. Mobile web browsers can also benefit from mobile cloud computing to improve the responsiveness and energy efficiency. This paper surveys current issues of mobile web browsers and approaches to optimize mobile web browsers, including client side approaches and cloud-based approaches. We also discuss the challenges and future directions in mobile web browser optimization.

Dark silicon is pushing processor vendors to add more specialized units such as accelerators to commodity processor chips. Unfortunately this is done without enough care to security. In this paper we look at the security implications of integrated Graphical Processor Units (GPUs) found in almost all mobile processors. We demonstrate that GPUs, already widely employed to a variety of benign applications such as image rendering, can also be used to accelerate microarchitectural attacks (i.e., making them more effective) on commodity platforms. In particular, we show that an attacker can build all the necessary primitives for performing effective GPU-based microarchitectural attacks and that these primitives are all exposed to the web through standardized browser extensions, allowing side-channel and Rowhammer attacks from JavaScript. These attacks bypass state-of-the-art mitigations and advance existing CPU-based attacks: we show the first end-to-end microarchitectural compromise of a browser running on a mobile phone in under two minutes by orchestrating our GPU primitives. While powerful, these GPU primitives are not easy to implement due to undocumented hardware features. We describe novel reverse engineering techniques for peeking into the previously unknown cache architecture and replacement policy of the Adreno 330, an integrated GPU found in many common mobile platforms. This information is necessary when building shader programs implementing our GPU primitives. We conclude by discussing mitigations against GPU-enabled attackers.

SRAM (Static Random Access Memory) is one of the type of memory which holds the data bit without periodic refreshment. Compared with DRAM (Dynamic Random Access Memory) which requires periodic refreshment of data bit stored in it. Unlike Dynamic RAM, Static RAM uses a flip-flop circuit to store each data bit, whereas Dynamic RAM uses a capacitor to store the data bit. But capacitor has tendency of losing charge which requires periodic refreshment. Thus SRAM perform better and have more stability than DRAM especially in idle state. In this work, we analysed the performance of the SRAM cell which are built with different field effect transistors and calculated the Write and Read delays, PDP (Power Delay Product) and Static Noise Margin (SNM) for all types of transistors. SRAM cell which is based on the CNT technology with optimized parameters of CNT density, CNT diameter and CNTFET flat band voltage has the better performance and stability compared with other device technologies. Optimized CNTFET SRAM cell compared with the MOSFET based SRAM the write and read delays are improved by 85.8% and 94.3% respectively. All the simulations have been carried out using HSPICE tool for 32nm technology node.

Although the web browser has become a standard interface for information access on the Web, the mobile web browser on the smartphone does not hold the same interest to mobile users. A survey with 11 mobile users shows that only 18% of the participants like mobile web browsers, whereas 82% of them like other mobile applications. This research focuses on understanding mobile users' difficulties and proposes innovative ideas to enhance mobile web browsing. This research enhances mobile browsing and reading in three directions: (1) dynamically generating mobile web sites for browsing (2) using orientation sensor information to detect natural interactions and text-to-speech (TTS) to continue reading between different activities, and (3) providing a speech interface to ease web navigation and supporting dialog programming for repetitive tasks. The Read4Me Browser is a prototype system built to demonstrate the proposed ideas.

The web browser is one of the major channels to access the Internet on mobile devices. Based on the smartphone usage logs from millions of real-world Android users, it is interesting to find that about 38% users have more than one browser on their devices. However, it is unclear whether the quality of browsing experiences are different when visiting the same webpage on different browsers. In this paper, we collect 3-week consecutive traces of 337 popular webpages on three popular mobile browsers: Chrome, Firefox, and Opera. We first use a list of metrics and conduct an empirical study to measure the differences of these metrics on different browsers. Then, we explore the variety of loading time and cache performance of different browsers when visiting the same webpage, which has a great impact on the browsing experience. Furthermore, we try to find which metrics have significant effect on the differences, investigating the possible causes. Finally, according to our findings, we give some recommendations to web developers, browser vendors, and end users.

With the popularity of mobile devices, wearables and auxiliaries such as stylus, a number of possible modes for interaction are available. However, the concept of simultaneous copying of multiple snippets of text is not yet widely available. It might be useful to the user to paste multiple snippets of text simultaneously, rather than copy and paste individual snippets multiple times. Multiple copy and paste is especially useful for mobile devices given the limited screen size and number of cumbersome operations involved. In this paper, we modify the architecture of the web browser to support this operation of multiple copy and paste. We present the modified web browser architecture and implementation details of the system, along with some user interactions in which the feature for multiple text snippet copy and paste can be implemented. We also present a usability study to determine how usable the feature for multiple copy and paste was found by a group of users.

A model for estimating the cosmic ray induced bit error rate in dynamic MOS RAMs is developed and used to calculate the bit error rate in NMDS dynamic RAMs used in an operating satellite system. The calculated error rate agrees sufficiently well with the observed error rate to conclude that cosmic ray ionization is a likely cause of observed satellite bit errors. The susceptibility of M1S RAMs to cosmic ray induced error is a result of the small charge (sub-picocoulamb) typically stored on a MDS gate to represent a data bit. Relatively small energy deposition (a few MeV) can discharge a storage node, resulting in a bit error. The heavy ion particles present in galactic cosmic rays can provide this energy, resulting in a significant bit error rate for large nmeory systems in satellites. The dynamic RAM operational factors and design factors affecting ionization-induced bit error rates are discussed.

Multiple entities in the smartphone ecosystem employ various methods to provide better web browsing experience. In this paper, we take a first comprehensive examination of the resource usage of mobile web browsing by focusing on two important types of resources: bandwidth and energy. Using a novel traffic collection and analysis tool, we examine a wide spectrum of important factors including protocol overhead, TCP connection management, web page content, traffic timing dynamics, caching efficiency, and compression usage, for the most popular 500 websites. Our findings suggest that that all above factors at different layers can affect resource utilization for web browsing, as they often poorly interact with the underlying cellular networks. Based on our findings, we developed novel recommendations and detailed best practice suggestions for mobile web content, browser, network protocol, and smartphone OS design, to make mobile web browsing more resource efficient.

Cloud computing is one of the most important business models of modern information technology. It provides a minimum of various services to the user interaction and low cost (hardware and software). Cloud services are based on the newline architectures on virtualization by using the multitenancy for better resource management and newline strong isolation between several virtual machines (VMs). The spying on a victim VM is challenging, particularly when one wants to use per‐core microarchitectural features as a side channel. For example, the cache contains the most potential for damaging side channels, but shared information across different cores affects the cloud information. To overcome this problem, propose the Secure Block‐Level Double Encryption (SBLDE) algorithm for user signature verification in the cloud server. It uses identity‐based detection techniques to monitor the colocated VMs to identify abnormal cache data and channel behaviors typically during VM data transformation. The identity‐based linear classification (IBLC) method is used for classifying the attacker channel when the data is transferred/retrieved from the VM cloud server. This cloud controller finds the channel misbehavior to block the port or channel, changing other available ports’ communication. The service verification provides strong user access permission on the cloud server when the unknown request to the cloud server suddenly executes the key authentication to verify the user permission. This linear classification trains the existing side‐channel attack datasets to the classifier and identifies the VM cloud’s attack channel. The study focused on preventing attacks from interrupting the system and serves as an effective means for cross‐VM side‐channel attacks. This proposed method protects the cloud data and prevents cross‐VM channel attack detection efficiently, compared to other existing methods. In this overall proposed method, SBLDE’s performance is to be evaluated and then compared with the existing method.

BackgroundPatient portals are a health information technology that allows patients and their proxies, such as caregivers and family members, to access designated portions of their electronic health record using mobile devices and web browsers. The Open Notes initiative in the United States, which became federal law in April 2021, has redrawn and expanded the boundaries of medical records. Only a few studies have focused on sharing notes with parents or caregivers of pediatric patients.ObjectiveThis study aimed to investigate the anticipated impact of increasing the flow of electronic health record information, specifically physicians’ daily inpatient progress notes, via a patient portal to parents during their child’s acute hospital stay—an understudied population and an understudied setting.MethodsA total of 5 in-person focus groups were conducted with 34 stakeholders most likely impacted by sharing of physicians’ inpatient notes with parents of hospitalized children: hospital administrators, hospitalist physicians, interns and resident physicians, nurses, and the parents themselves.ResultsDistinct themes identified as benefits of pediatric inpatient Open Notes for parents emerged from all the 5 focus groups. These themes were communication, recapitulation and reinforcement, education, stress reduction, quality control, and improving family-provider relationships. Challenges identified included burden on provider, medical jargon, communication, sensitive content, and decreasing trust.ConclusionsProviding patients and, in the case of pediatrics, caregivers with access to medical records via patient portals increases the flow of information and, in turn, their ability to participate in the discourse of their care. Parents in this study demonstrated not only that they act as monitors and guardians of their children’s health but also that they are observers of the clinical processes taking place in the hospital and at their child’s bedside. This includes the clinical documentation process, from the creation of notes to the reading and sharing of the notes. Parents acknowledge not only the importance of notes in the clinicians’ workflow but also their collaboration with providers as part of the health care team.

The mobile phones are increasingly used to access different kind of information other than just to make voice calls. However, browsing large web pages which is not adapted for small-screen viewing is still very inconvenient. Web browsers are emerging which try to solve the interaction problems that occur when small-screen devices are used to access web pages designed for large screen viewing. This paper presents the results of the usability study in which users' mobile web browsing experience was evaluated in comparison to desktop Web browsing. The results indicate the users' performance was poor on mobile browser as users expected similar experience as on desktop; however for some users familiarity of web on desktop helped instead to navigate easily on mobile browser. The main problem participants had was difficulty of locating the content in long narrow page, which in turn caused extensive scrolling. This research suggests some improvement for mobile web browser and important consideration in designing mobile friendly websites that could help limit a lot of scrolling and increase the readability.