Star 0

Abstract

In this talk, we present the first practical cache covert channel in the cloud. The goal is to secretly exfiltrate sensitive data from one fully isolated virtual machine to another virtual machine on the same physical host. Both communication endpoints require no privileges and run as regular user programs. Our attack exploits the CPU cache that is present in all modern processors. These caches are crucial to performance; they are shared across virtual machine boundaries and thus violate isolation guarantees. Cache covert channels have been discussed in many academic works; however, a practical application has not been demonstrated so far. One reason is that especially hypervisor activity and external events disrupt communication. Our covert channel is resilient against noise as we adapt established techniques from wireless transmission protocols. Even with extraordinarily high system activity, our covert channel stays entirely error free while maintaining high throughput and low latency. We sustain transmission rates of more than 45 KB/s on the Amazon EC2 cloud, exceeding state of the art by 3 orders of magnitude. Our protocol allows us to build an SSH connection between two virtual machines, where all existing covert channels fail. We demonstrate our covert channel attacks on the Amazon cloud live on stage, including interactive SSH sessions and video streaming. Finally, we present an open-source tool that helps security researchers in investigating the underlying hardware problem and assessing the risk for their infrastructure.