"Microarchitectural attacks: reflecting on 45 years of research since 'A note on the confinement problem'"

No ratings

Presented at BSidesCanberra 2018 by

Paul Harvey

2018 started with Meltdown and Spectre, some of the most difficult and expensive industry-wide vulnerabilities we've seen. But did you know that branch mis-prediction side-channels had been measured as a threat to inter-process isolation in 2014? Or that hardware fault injection attacks against RSA encryption have been discussed since 1997? Or that the threat high-resolution timers pose was first discussed in 1974? 44 years later, web browsers are only now softening high-resolution timers in response to Meltdown/Spectre... We'll take a whirlwind tour through a random sampling of attack and defense research over the last few decades that punches holes through the most basic layers of abstraction we've long been complacent with: the humble CPU, and the hardware around it. We'll see how the microarchitectural complexity alarm bells have been ringing for quite some time, how "the confinement problem" has evolved over the years, and what design principles are needed for resilient solutions today.