The paper ARMageddon: Cache Attacks on Mobile Devices have been included in 25th USENIX Security Symposium. The creators of the paper are Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clémentine Maurice, and Stefan Mangard from the Graz University of Technology. The researchers have presented a cache attack on multi-core ARM CPUs on Android devices for the first time.
The attacks presented by the researchers are complex and rely on various individual building blocks. Similar attack techniques are used against Intel x86 processor-based systems. Modern smartphones have different cache organization and instruction set than Intel x86 CPUs because they use one or more multi-core ARM CPUs. However, it appears that some of the attack techniques against Intel platforms are highly efficient cache attacks on ARM.
A CPU cache attack is a side-channel information leak attack. Third-parties can extract small portions of data from CPU cache when a CPU cache attack is running. The data from the CPU cache can infer the attacker information about the data that was being processed.
The ARMageddon Cache Attack Scope and Actions
Hundreds of million Android devices can be attacked by the techniques implemented by the five researchers from the Graz University of Technology.
“Our attacks are applicable to hundreds of millions of today’s off-the-shelf smartphones as they all have very similar if not identical hardware,” the paper says.
Many mobile phones (about 98%) have built on ARM processors. Many companies, including Apple, Cirrus Logic, Intel, LG, Microsoft, NEC, Nintendo, Nvidia, Sony, Samsung, Sharp, Texas Instruments, and Yamaha have licensed the ARM architecture and use it for the development of their devices.
The efficient cross-core attack techniques Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush, have been applied to smartphones for the first time. Thus the researchers were able to monitor tap and swipe gestures sent to the CPU for processing. They have successfully observed touch and swipe actions on the screen, touch actions on the soft-keyboard, and inter-keystroke timings.
“Moreover, we present attacks to monitor tap and swipe events as well as keystrokes and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java.“
ARMageddon Cache Attack Penetrates the ARM TrustZone
The ARM TrustZone is a hardware-based security technology that provides a secure execution environment and is built into ARM CPUs. This environment is isolated from the normal world using hardware support. It is a special area of Android OS that processes sensitive cryptographic operations. Anyway when the researchers put into use the cross-core attack technique Prime+Probe against Android devices they have successfully observed the cache activity in the ARM TrustZone. Furthermore, the attack can be implemented without elevated privileges.
The code used in the attacks could be seen on GitHub as the researchers have released it there.
