Generic and Automated Drive-by GPU Cache Attacks from the Browser - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2024

Generic and Automated Drive-by GPU Cache Attacks from the Browser

Résumé

In recent years, the use of GPUs for general-purpose computations has steadily increased. As security-critical computations like AES are becoming more common on GPUs, the scrutiny must also in- crease. At the same time, new technologies like WebGPU put easy access to compute shaders in every web browser. Prior work has shown that GPU caches are vulnerable to the same eviction-based attacks as CPUs, e.g., Prime+Probe, from native code. In this paper, we present the first GPU cache side-channel attack from within the browser, more specifically from the restricted We- bGPU environment. The foundation for our generic and automated attacks are self-configuring primitives applicable to a wide variety of devices, which we demonstrate on a set of 11 desktop GPUs from 5 different generations and 2 vendors. We leverage features of the new WebGPU standard to create shaders that implement all building blocks needed for cache side-channel attacks, such as tech- niques to distinguish L2 cache hits from misses. Beyond the state of the art, we leverage the massive parallelism of modern GPUs to design the first parallelized eviction set construction algorithm. Based on our attack primitives, we present three case studies: First, we present an inter-keystroke timing attack with high F1-scores, i.e., 82 % to 98 % on NVIDIA. Second, we demonstrate a generic, set-agnostic, end-to-end attack on a GPU-based AES encryption service, leaking a full AES key in 6 minutes. Third, we evaluate a native-to-browser data-exfiltration scenario with a Prime+Probe covert channel that achieves transmission rates of up to 10.9 kB/s. Our attacks require no user interaction and work in a time frame that easily enables drive-by attacks while browsing the Internet. Our work emphasizes that browser vendors need to treat access to the GPU similar to other security- and privacy-related resources.
Fichier principal
Vignette du fichier
2024-asiaccs-webgpu.pdf (760.19 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04613708 , version 1 (19-06-2024)

Identifiants

Citer

Lukas Giner, Roland Czerny, Christoph Gruber, Fabian Rauscher, Andreas Kogler, et al.. Generic and Automated Drive-by GPU Cache Attacks from the Browser. ACM Asia Conference on Computer and Communications Security (ASIA CCS ’24), Jul 2024, Singapore, Singapore. ⟨10.1145/3634737.3656283⟩. ⟨hal-04613708⟩
0 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More