- Unintentional and Hidden Information Leaks in Networked Software Applications (2012)
- Side channels are vulnerabilities that can be attacked by observing the behaviour of applications and by inferring sensitive information just from this behaviour. Because side channel vulnerabilities appear in such a large spectrum of contexts, there does not seem to be a generic way to prevent all side channel attacks once and for all. A practical approach is to research for new side channels and to specifically tailor mitigations for new side channel attacks. In this thesis, we extend the field of side channel attacks by introducing new ways to attack and to mitigate side channels in web applications. We start by proposing a new classification scheme for information leaks based on the information decoding effort an attacker has to spend. The four differ- ent classes—sorted by the order of ascending effort for the attacker—are: direct deterministic information leaks, obfuscated deterministic information leaks, pos- sibilistic information leaks, and probabilistic information leaks. Storage side channels are a new type of side channels which leak information through redundancies in protocols such as HTTP or languages such as HTML. We formalise storage side channels and describe a new method that allows de- tecting obfuscated deterministic information leaks in storage side channels even in dynamic and noisy environments. We test our method by applying it to real- world web applications and find that several widely used web applications are prone to obfuscated deterministic information leaks. Furthermore, we show a new method to exploit those timing side channels that have the property that the timing differences can be influenced by the at- tacker. We model these special timing side channels as a possibilistic timing side channel. The method allows very efficient timing side channel attacks even over noisy networks such as the Internet. We show that our method can break the confidentiality of XML Encryption messages in realistic environments. Finally, we model common existing timing side channels in web applications as probabilistic information leaks and present a new method to mitigate them in web applications. The method works by padding the response time using a deterministic and unpredictable delay (DUD). We show that DUD offers security guarantees that can be freely traded with performance reduction. By applying this method to vulnerable web applications, we show that the method offers an effective and performant way to mitigate timing side channels.
- Information Leakage behind the Curtain: Abusing Anti-EMI Features for Covert Communication (2016)
- We present a new class of covert channels which can be created by utilizing common hardware but that cannot be detected by such. Our idea is to abuse anti-EMI features of a processor to create a covert channel on the physical layer. Thus, the sender uses the invariants in how digital signals are encoded over analog channels to covertly transport information. This leaked data is present on the wire bound connections of the compromised device, but is also by definition present in the vicinity of the device and can be picked up by radio equipment. As the covert channel is present only on the physical layer, the data on all layers above, as well as the timing behavior on those layers is indistinguishable from uncompromised devices. We present two example implementations of such channels using RS-232 as the carrier and use a common oscilloscope to decode the resulting covert channel. Using this setup, we observed symbol rates of around 5 baud. We derive the theoretical upper bound of the covert channels bandwidth and discuss the factors by which it is influenced.