DOCSLIB.ORG

Detecting Peripheral-Based Attacks on the Host Memory

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Detecting Peripheral-Based Attacks on the Host Memory Fakultat¨ fur¨ Elektrotechnik und Informatik Institut fur¨ Softwaretechnik und Theoretische Informatik Lehrstuhl fur¨ Security in Telecommunications Detecting Peripheral-based Attacks on the Host Memory vorgelegt von Dipl.-Inform. Patrick Stewin { geb. in Staaken (jetzt Berlin-Spandau) { von der Fakult¨atIV { Elektrotechnik und Informatik der Technischen Universit¨atBerlin zur Erlangung des akademischen Grades Doktor der Ingenieurwissenschaften { Dr.-Ing. { genehmigte Dissertation Promotionsausschuss: Vorsitzender: Prof. Dr. Hans-Ulrich Heiß, Technische Universit¨atBerlin Gutachter: Prof. Dr. Jean-Pierre Seifert, Technische Universit¨atBerlin Gutachter: Prof. Dr. Konrad Rieck, Georg-August-Universit¨atG¨ottingen Gutachter: Prof. Dr.-Ing. Volker Roth, Freie Universit¨atBerlin Tag der wissenschaftlichen Aussprache: 18. Juli 2014 Berlin 2014 D83 Ich versichere von Eides statt, dass ich diese Dissertation selbst¨andigverfasst und nur die angegebenen Quellen und Hilfsmittel verwendet habe. Datum i/ix Abstract Adversaries can deploy rootkit techniques on the target platform to persistently attack computer systems in a stealthy manner. Industrial and political espionage, surveillance of users as well as conducting cybercrime require stealthy attacks on computer systems. Utilizing a rootkit technique means, that a part of the im- plemented attack code is responsible for concealing the attack. Attack code that is loaded into peripherals such as the network interface card or special micro-controllers currently are the peak of the evolution of rootkits. This work examines such stealthy peripheral-based attacks on the host computer. Peripherals have a dedicated pro- cessor and dedicated runtime memory to handle their tasks. This means that these peripherals are essentially a separate system. Attackers benefit from this kind of iso- lation. Peripherals generally communicate with the host via the host main memory. Attackers exploit this fact. All host runtime data is present in the main memory. This includes cryptographic keys, passwords, opened files, and other sensitive data. The attacker only needs to locate such data. Subsequently, attackers can read and modify the data unbeknownst by utilizing the direct memory access mechanism of the peripheral. This allows for circumventing security software such as state-of-the- art anti-virus software and modern hardened operating system kernels. Detecting such attacks is the goal of this work. Stealthy malicious software (malware) that is based on an isolated micro-controller is implemented to conduct an attack analysis. The malware proof of concept is called DAGGER, which is de- rived from Direct memory Access based keystroke code loGGER. The development and analysis of this malware reveals important properties of peripheral-based mal- ware. The results of the analysis are the basis for the development of a novel runtime detector. The detector is called BARM{ Bus Agent Runtime Monitor. This detec- tor reveals stealthy peripheral-based attacks on the host main memory by exploiting certain hardware properties. A permanent and resource-efficient measurement strat- egy ensures that the detector is also capable of detecting transient attacks. Such transient attacks are possible when the applied measurement strategy only measures at certain points in time. The attacker exploits this measurement strategy by at- tacking the system in between two measurements and by destroying all attack traces before the system is measured. The detector represents an alternative solution for previously proposed preventive protection approaches, i. e., input/output memory management units. Previously proposed approaches are not necessarily effective due to practical issues. This fact as well as the threat posed by peripheral-based mal- ware demand the alternative detector solution that is presented in this work. The detector does not only reveal an attack, but also halt the malicious device. BARM immediately detects and prevents attacks that are conducted by DAGGER. The performance overhead is negligible. Furthermore, BARM is able to report if the host main memory is attacked by a peripheral to an external platform. \Detecting Peripheral-based Attacks on the Host Memory" ii/ix \Detecting Peripheral-based Attacks on the Host Memory" iii/ix Zusammenfassung Um Computersysteme unerkannt und dauerhaft zu attackieren, k¨onnenAngreifer Rootkit-Techniken auf der Zielplattform einsetzen. Industriespionage sowie Spi- onage auf politischer Ebene, das Uberwachen¨ von Computerbenutzern oder Ver- brechen im Umfeld der Cyberkriminalit¨aterfordern heimliche Angriffe. Eine Rootkit- Technik anzuwenden bedeutet, dass ein Teil des implementierten Angriffscodes f¨ur die Tarnung der Attacke zust¨andigist. Angriffscode, der in Peripherieger¨atenwie zum Beispiel der Netzwerkkarte zur Ausf¨uhrungkommt, repr¨asentiert momentan den Gipfel der Rootkit-Evolution. Diese Arbeit untersucht solche vermeintlich heim- lichen peripheriebasierten Attacken auf den Hostcomputer. Peripherieger¨atehaben einen dedizierten Prozessor sowie dedizierten Laufzeitspeicher, um ihre Aufgaben zu erf¨ullen. Somit stellen diese Ger¨ateseparierte Systeme dar. Angreifer profi- tieren von dieser Art der Isolierung. Peripherieger¨atekommunizieren ¨ublicherweise ¨uber den Hauptspeicher mit dem Hostsystem. Angreifer nutzen genau diesen Um- stand aus. S¨amtliche Laufzeitdaten des Hosts befinden sich im Hauptspeicher. Dazu z¨ahlenunter anderem kryptografische Schl¨ussel,Passw¨orter,ge¨offneteDateien sowie weitere sensible Daten. Der Angreifer braucht diese Daten lediglich zu lokalisieren. Dann kann der Angreifer mittels direktem Speicherzugriff des Peripherieger¨atesdie Daten unerkannt auslesen oder modifizieren. Dabei werden Sicherheitsprogramme wie dem Stand der Technik entsprechende Antivirensoftware oder moderne geh¨artete Betriebssystemkerne umgangen. Ziel dieser Arbeit ist es, solche heimlichen Angriffe zu enttarnen. Es wird ein heimlicher Angriff mit Hilfe eines speziellen vom Hostcomputer isolierten Mikro- Controllers zu Analysezwecken implementiert. Der zugeh¨origeProof of Concept wird DAGGER genannt, was vom englischen Direct memory Access based keystroke code loGGER abgeleitet ist. Die Entwicklung und Analyse dieses heimlichen Angriffs bringt wichtige Eigenschaften von peripheriebasierter b¨osartigerSoftware zu Tage. Mit den gewonnenen Erkenntnissen wird ein neuartiger Detektor entwickelt. Der De- tektor wird BARM genannt. BARM steht f¨ur Bus Agent Runtime Monitor. Dieser Detektor deckt mit Hilfe bestimmter Hardwareeigenschaften heimliche Hauptspei- cherattacken auf. Durch eine permanente und ressourcenschonende Messstrategie ist der Detektor in der Lage, kurzlebige Attacken zu enttarnen. Solche Attacken sind m¨oglich, wenn nur zu bestimmten Zeitpunkten gemessen wird. Diese Messstrate- gie kann der Angreifer ausnutzen, indem er zwischen zwei Messungen angreift und rechtzeitig vor der kommenden Messung seine Spuren verwischt. Der Detektor repr¨asentiert eine alternative L¨osungzu bisherigen pr¨aventiven Schutzsans¨atzenwie zum Beispiel zu Memory Management Units, die die Ein- und Ausgaben von Pe- ripherieger¨atenber¨ucksichtigen k¨onnen.Die bisherigen pr¨aventiven Ans¨atzebieten aufgrund der praktischen Umsetzung nicht notwendigerweise ausreichend Schutz. Diese Tatsache sowie das Bedrohungspotential, das von kompromittierten Periphe- rieger¨atenausgeht, verlangt nach der in dieser Arbeit vorgestellten alternativen De- tektorl¨osung. Der Detektor kann Angriffe nicht nur aufdecken, sondern auch un- terbinden. BARM detektiert und stoppt DAGGER-Angriffe unverz¨uglich. Dabei \Detecting Peripheral-based Attacks on the Host Memory" iv/ix entstehen lediglich unbedeutende Leistungsverluste. Zus¨atzlich ist BARM in der Lage, zuverl¨assigeiner externen Plattform mitzuteilen, ob der Hauptspeicher durch ein Peripherieger¨atangegriffen wird. \Detecting Peripheral-based Attacks on the Host Memory" v/ix Publications Related to this Thesis The work presented in this thesis resulted in the following peer-reviewed publica- tions: Understanding DMA Malware, Patrick Stewin and Iurii Bystrov, DIMVA2012 Proceedings of the 9th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Heraklion, Crete, Greece, July 26-27th, 2012 ([see 123] / Chapter4) Extended Abstract { Poster: Towards Detecting DMA Malware, Patrick Stewin, Jean-Pierre Seifert, Collin Mulliner, CCS2011 Proceedings of the 18th ACM Conference on Computer and Communications Security, 2011 ([see 126] / Chapter4) A Primitive for Revealing Stealthy Peripheral-based Attacks on the Comput- ing Platform's Main Memory, Patrick Stewin, RAID2013 Proceedings of the 16th International Symposium on Research in Attacks, Intrusions and Defenses (RAID), St. Lucia, October 23-25, 2013 ([see 122] / Chapter5) The following peer-reviewed publications were updated for Chapter6 to consider the DMA based malware scenario that is the focus of this thesis: Beyond Secure Channels, Yacine Gasmi, Ahmad-Reza Sadeghi, Patrick Stewin, Martin Unger, N. Asokan, STC2007 Proceedings of the 2007 ACM Workshop on Scalable Trusted Computing, 2007 ([see 52]) An Efficient Implementation of Trusted Channels based on OpenSSL, Fred- erik Armknecht, Yacine Gasmi, Ahmad-Reza Sadeghi, Patrick Stewin, Martin Unger, Gianluca Ramunno, Davide Vernizzi, STC2008 Proceedings of the 3rd ACM Workshop on Scalable Trusted Computing, 2008 ([see 10]) \Detecting Peripheral-based Attacks on the Host Memory" vi/ix \Detecting Peripheral-based Attacks on the Host Memory" Contents Abstracti
Load more

Recommended publications
  • 2Nd Generation Intel Core Processor Family with Intel 6 Series Chipset Development Kit User Guide
    2nd Generation Intel® Core™ Processor Family with Intel® 6 Series Chipset Development Kit User Guide March 2011 Document Number: 325208 About This Document INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR DEATH MAY OCCUR. Intel may make changes to specifications and product descriptions at any time, without notice. Intel Corporation may have patents or pending patent applications, trademarks, copyrights, or other intellectual property rights that relate to the presented subject matter. The furnishing of documents and other materials and information does not provide any license, express or implied, by estoppel or otherwise, to any such patents, trademarks, copyrights, or other intellectual property rights. Designers must not rely on the absence or characteristics of any features or instructions marked “reserved” or “undefined.” Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. Intel processor numbers are not a measure of performance.
    [Show full text]
  • CIS 4360 Secure Computer Systems Attacks Against Boot And
    CIS 4360 Secure Computer Systems Attacks against Boot and RAM Professor Qiang Zeng Spring 2017 Previous Class • BIOS-MBR: Generation I system boot – What BIOS and MBR are? – How does it boot the system? // Jumping to MBR – How does multi-boot work? // Chain-loading • The limitations of BIOS and MBR – Disk, memory, file system, multi-booting, security, … • UEFI-GPT: Generation II system boot – What UEFI and GPT are? – How does it boot the system? // UEFI boot manager – How does multi-boot work? // separate dirs in ESP CIS 4360 – Secure Computer Systems 2 Limitations of BIOS-MBR • MBR is very limited – Support ~2TB disk only – 4 primary partitions at most (so four OSes at most) – A MBR can store only one boot loader • BIOS is very restrictive – 16-bit processor mode; 1MB memory space (little spare space to accommodate a file system driver) – Blindly executes whatever code on MBR CIS 4360 – Secure Computer Systems 3 UEFI vs. BIOS • Disk partitioning schemes – GPT (GUID Partition Table): part of UEFI spec.; to replace MBR – MBR supports disk size 232 x 512B = 2TB, while UEFI supports much larger disks (264 x 512B ＝ 8,000,000,000 TB) – MBR supports 4 partitions, while GPT supports 128 • Memory space – BIOS: 20-bit addressing; UEFI: 32-bit or 64-bit • Pre-OS environment – BIOS only provides raw disk access, while UEFI supports the FAT file system (so you can use file names to read files) • Booting – BIOS supports boot through boot sectors (MBR and VBR) – UEFI provides a boot partition of hundreds of megabytes (and boot manager and secure boot) CIS 4360 – Secure Computer Systems 4 Previous Class How does dual-boo-ng of Linux and Windows work in UEFI-GPT? Each vendor has a separate directory storing its own boot loader code and configuraon files in the ESP (EFI System Par--on).
    [Show full text]
  • The New Intel® Xeon® Processor Scalable Family
    Akhilesh Kumar Intel Corporation, 2017 Authors: Don Soltis, Irma Esmer, Adi Yoaz, Sailesh Kottapalli Notices and Disclaimers This document contains information on products, services and/or processes in development. All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest forecast, schedule, specifications and roadmaps. Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Learn more at intel.com, or from the OEM or retailer. No computer system can be absolutely secure. Software and workloads used in performance tests may have been optimized for performance only on Intel microprocessors. Performance tests, such as SYSmark and MobileMark, are measured using specific computer systems, components, software, operations and functions. Any change to any of those factors may cause the results to vary. You should consult other information and performance tests to assist you in fully evaluating your contemplated purchases, including the performance of that product when combined with other products. For more complete information visit http://www.intel.com/performance. Optimization Notice: Intel's compilers may or may not optimize to the same degree for non-Intel microprocessors for optimizations that are not unique to Intel microprocessors. These optimizations include SSE2, SSE3, and SSSE3 instruction sets and other optimizations. Intel does not guarantee the availability, functionality, or effectiveness of any optimization on microprocessors not manufactured by Intel. Microprocessor-dependent optimizations in this product are intended for use with Intel microprocessors. Certain optimizations not specific to Intel microarchitecture are reserved for Intel microprocessors. Please refer to the applicable product User and Reference Guides for more information regarding the specific instruction sets covered by this notice.
    [Show full text]
  • Iocheck: a Framework to Enhance the Security of I/O Devices at Runtime
    IOCheck: A Framework to Enhance the Security of I/O Devices at Runtime Fengwei Zhang Center for Secure Information Systems George Mason University Fairfax, VA 22030 [email protected] Abstract—Securing hardware is the foundation for implement- Management Mode (SMM), a CPU mode in the x86 archi- ing a secure system. However, securing hardware devices remains tecture, to quickly check the integrity of I/O configurations an open research problem. In this paper, we present IOCheck, and firmware. Unlike previous systems [11], [12], IOCheck a framework to enhance the security of I/O devices at runtime. enumerates all of the I/O devices on the motherboard, and It leverages System Management Mode (SMM) to quickly check checks the integrity of their corresponding configurations and the integrity of I/O configurations and firmware. IOCheck does not rely on the operating system and is OS-agnostic. In our firmware. IOCheck does not rely on the operating system, preliminary results, IOCheck takes 4 milliseconds to switch to which significantly reduces the Trust Computing Base (TCB). SMM which introduces low performance overhead. In addition, IOCheck is able to achieve better performance compared to TXT or SVM approaches. For example, the SMM Keywords—Integrity, Firmware, I/O Configurations, SMM switching time is much faster than the late launch method in Flicker [10], [13]. We will demonstrate that IOCheck is able to check the integrity of array of I/O devices including the BIOS, I. INTRODUCTION IOMMU, network card, video card, keyboard, and mouse. With the increasing complexity of hardware devices, Contributions. The purpose of this work is to make the firmware functionality is expanding, exposing new vulner- following contributions: abilities to attackers.
    [Show full text]
  • Im Divar Ip 6000 2U
    DIVAR IP 6000 2U DIP-6080-00N, DIP-6082-8HD, DIP-6083-8HD en Installation Manual DIVAR IP 6000 2U Table of Contents | en 3 Table of contents 1 Safety precautions 5 1.1 General safety precautions 5 1.2 Electrical safety precautions 6 1.3 ESD precautions 7 1.4 Operating precautions 7 1.5 Important notices 8 1.6 FCC and ICES compliance 8 2 System overview 9 2.1 Chassis features 9 2.2 Chassis components 9 2.2.1 Chassis 10 2.2.2 Backplane 10 2.2.3 Fans 10 2.2.4 Mounting rails 10 2.2.5 Power supply 10 2.2.6 Air shroud 10 2.3 System interface 10 2.3.1 Control panel buttons 11 2.3.2 Control panel LEDs 12 2.3.3 Drive carrier LEDs 12 3 Chassis setup and maintenance 13 3.1 Removing the chassis cover 13 3.2 Installing hard drives 14 3.2.1 Removing hard drive trays 14 3.2.2 Installing a hard drive 15 3.3 Installing an optional floppy or fixed hard drive 16 3.4 Installing or replacing a DVD-ROM drive 17 3.5 Replacing the internal transcoder device 17 3.6 Replacing or installing the front port panel 17 3.7 Installing the motherboard 18 3.8 Installing the air shroud 18 3.9 System fans 19 3.10 Power supply 20 3.10.1 Replacing the power supply 21 3.10.2 Replacing the power distributor 22 4 Rack installation 23 4.1 Unpacking the system 23 4.2 Preparing for setup 23 4.2.1 Choosing a setup location 23 4.2.2 Rack precautions 23 4.2.3 General system precautions 24 4.2.4 Rack mounting considerations 24 4.3 Rack mounting instructions 24 4.3.1 Separating the sections of the rack rails 25 4.3.2 Installing the inner rails 26 4.3.3 Installing the outer rails to the
    [Show full text]
  • Desktop 4Th Generation Intel® Core™ Processor Family, Desktop Intel® Pentium® Processor Family, and Desktop Intel® Celeron® Processor Family Datasheet – Volume 1 of 2
    Desktop 4th Generation Intel® Core™ Processor Family, Desktop Intel® Pentium® Processor Family, and Desktop Intel® Celeron® Processor Family Datasheet – Volume 1 of 2 July 2014 Order No.: 328897-008 By using this document, in addition to any agreements you have with Intel, you accept the terms set forth below. You may not use or facilitate the use of this document in connection with any infringement or other legal analysis concerning Intel products described herein. You agree to grant Intel a non-exclusive, royalty-free license to any patent claim thereafter drafted which includes subject matter disclosed herein. INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. A "Mission Critical Application" is any application in which failure of the Intel Product could result, directly or indirectly, in personal injury or death. SHOULD YOU PURCHASE OR USE INTEL'S PRODUCTS FOR ANY SUCH MISSION CRITICAL APPLICATION, YOU SHALL INDEMNIFY AND HOLD INTEL AND ITS SUBSIDIARIES, SUBCONTRACTORS AND AFFILIATES, AND THE DIRECTORS, OFFICERS, AND EMPLOYEES OF EACH, HARMLESS AGAINST ALL CLAIMS COSTS, DAMAGES, AND EXPENSES AND REASONABLE ATTORNEYS' FEES ARISING OUT OF, DIRECTLY OR INDIRECTLY, ANY CLAIM OF PRODUCT LIABILITY, PERSONAL INJURY, OR DEATH ARISING IN ANY WAY OUT OF SUCH MISSION CRITICAL APPLICATION, WHETHER OR NOT INTEL OR ITS SUBCONTRACTOR WAS NEGLIGENT IN THE DESIGN, MANUFACTURE, OR WARNING OF THE INTEL PRODUCT OR ANY OF ITS PARTS.
    [Show full text]
  • BRKINI-2390.Pdf
    BRKINI-2390 Data Center security within modern compute and attached fabrics - servers, IO, management Dan Hanson Director UCS Architectures and Technical Marketing Cisco Spark Questions? Use Cisco Spark to communicate with the speaker after the session How 1. Find this session in the Cisco Live Mobile App 2. Click “Join the Discussion” 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot#BRKINI-2390 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public Recent Press Items © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public Agenda • x86 Architecture Review • BIOS and Kernel Manipulation • Device Firmware Manipulation • On Server Data Storage Manipulation • Segmentation and Device access • Root of Trust Flow • Policy Control vs. Component Configuration (Cisco UCS and ACI) • Example of Security Offloading: Skyport Systems • Conclusion x86 Architecture Review Many Points of possible attack X86 Reference Legacy Elements • You may see many terms in various articles shown here • Over time, items moving on the CPU itself • Memory • PCIe • Processors/Servers differentiation in some areas • Front Side Bus speeds • Direct Media Interface • Southbridge Configurations BRKINI-2390 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 X86 Reference Fundamental Architecture • Not shown: Quick Path Interconnect/UltraPath Interconnect for CPU to CPU communications • Varied counts and speeds for multi-socket systems • Current Designs have On-Die PCIe and Memory controllers • Varied numbers and DIMMs in memory channels by CPU • Platform Controller Hub varies and can even offer server acceleration and security functions BRKINI-2390 © 2018 Cisco and/or its affiliates.
    [Show full text]
  • Dell EMC Poweredge C4140 Technical Guide
    Dell EMC PowerEdge C4140 Technical Guide Regulatory Model: E53S Series Regulatory Type: E53S001 Notes, cautions, and warnings NOTE: A NOTE indicates important information that helps you make better use of your product. CAUTION: A CAUTION indicates either potential damage to hardware or loss of data and tells you how to avoid the problem. WARNING: A WARNING indicates a potential for property damage, personal injury, or death. © 2017 - 2019 Dell Inc. or its subsidiaries. All rights reserved. Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners. 2019 - 09 Rev. A00 Contents 1 System overview ......................................................................................................................... 5 Introduction............................................................................................................................................................................ 5 New technologies.................................................................................................................................................................. 5 2 System features...........................................................................................................................7 Specifications......................................................................................................................................................................... 7 Product comparison.............................................................................................................................................................
    [Show full text]
  • ECE 571 – Advanced Microprocessor-Based Design Lecture 16
    ECE 571 { Advanced Microprocessor-Based Design Lecture 16 Vince Weaver http://www.eece.maine.edu/~vweaver [email protected] 31 March 2016 Announcements • Project topics • HW#8 will be similar, about a modern ARM chip 1 Busses • Grey Code, only one bit change when incrementing. Lower energy on busses? (Su and Despain, ISLPED 1995). 2 Reading of the Webpage http://anandtech.com/show/9582/intel-skylake-mobile-desktop-launch-architecture-analysis/ The Intel Skylake Mobile and Desktop Launch, with Architecture Analysis by Ian Cutress 3 Background on where info comes from Intel Developer Forum This one was in August 4 Name tech Year Conroe/Merom 65nm Tock 2006 Penryn 45nm Tick 2007 Nehalem 45nm Tock 2008 Westmere 32nm Tick 2010 Sandy Bridge 32nm Tock 2011 Ivy Bridge 22nm Tick 2012 Haswell 22nm Tock 2013 Broadwell 14nm Tick 2014 Skylake 14nm Tock 2015 Kaby Lake? 14nm Tock 2016 5 Clock: tick-tock. Upgrade the process technology, then revamp the uarch. 14nm technology? Finfets? What technology are Pis at? 40nm? 14nm yields getting better. hard to get, even with electron beam lithography plasma damage to low-k silicon only 0.111nm finfet. Intel has plants Arizona, etc. Delay to 10nm 7nm? EUV? 6 Skylake Processor { Page 1 • 4.5W ultra-mobile to 65W desktop They release desktop first these days. For example just today releasing \Xeon E5-2600 v4" AKA Broadwell-EP Confusing naming i3, i5, i7, Xeon, Pentium, m3, m5, m7, etc. Number of pins important. Low-power stuck with LPDDR3/DDR3L instead of DDR4 possibly due to lack of pins? eDRAM? 7 Intel no longer releasing info on how many transistors/transistor size? 8 Skylake Processor { Page 2 • \mobile first” design.
    [Show full text]
  • IOMMU-Resistant DMA Attacks
    IOMMU-resistant DMA attacks Gil Kupfer Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 IOMMU-resistant DMA attacks Research Thesis Submitted in partial fulfillment of the requirements for the degree of Master of Science in Computer Science Gil Kupfer Submitted to the Senate of the Technion | Israel Institute of Technology Sivan 5778 Haifa May 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 This research was carried out under the supervision of Prof. Dan Tsafrir and Dr. Nadav Amit, in the Faculty of Computer Science. Acknowledgements who passed ,ז"ל This work is dedicated to my grandfather, Tuvia Kupfer away during the writing of this work. I would like to thank my wife, Odeya, for helping and supporting when needed. Also, I would like to thank all the friends who have been there. Finally, thanks to my advisors, Prof. Dan Tsafrir and Dr. Nadav Amit, for their help and guidance along the way. The generous financial help of the Technion is gratefully acknowledged. Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Technion - Computer Science Department - M.Sc. Thesis MSC-2018-21 - 2018 Contents List of Figures Abstract 1 Abbreviations and Notations3 1 Introduction5 2 Background9 2.1 DMA Attacks.................................9 2.1.1 Classic DMA Attacks........................9 2.1.2 IOMMU Protection......................... 10 2.1.3 Circumventing the IOMMU..................... 11 2.2 FireWire.................................... 12 3 Attack Mechanics 15 3.1 Sub-Page Granularity Vulnerability....................
    [Show full text]
  • Bypassing IOMMU Protection Against I/O Attacks Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche
    Bypassing IOMMU Protection against I/O Attacks Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche To cite this version: Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche. Bypassing IOMMU Protection against I/O Attacks. 7th Latin-American Symposium on Dependable Computing (LADC’16), Oct 2016, Cali, Colombia. pp.145-150, 10.1109/LADC.2016.31. hal-01419962 HAL Id: hal-01419962 https://hal.archives-ouvertes.fr/hal-01419962 Submitted on 20 Dec 2016 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Bypassing IOMMU protection against I/O Attacks Benoˆıt Morgan, Eric´ Alata, Vincent Nicomette, Mohamed Kaanicheˆ LAAS-CNRS, Universite´ de Toulouse, CNRS, INSA, Toulouse, France 7 Avenue du Colonel Roche 31000 Toulouse Email: [email protected], [email protected], [email protected], [email protected] Abstract—Attacks targeting computer systems become more and RAM memory segments. These communication channels and more complex and various. Some of them, so-called I/O raise serious concerns about the security of such architectures, attacks, are performed by malicious peripherals that make read since they open some opportunities to attackers to compromise or write accesses to DRAM memory or to memory embedded in other peripherals, through DMA (Direct Memory Access) the system and hosted applications using some malicious requests.
    [Show full text]
  • Intel® Coretm 2 Duo Processor and Mobile Intel® GME965 Express Chipset
    Intel® CoreTM 2 Duo processor and Mobile Intel® GME965 Express Chipset Development Kit User Manual June 2007 Document Number: 316704-001 INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL'S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. Intel products are not intended for use in medical, life saving, life sustaining, critical control or safety systems, or in nuclear facility applications. Intel may make changes to specifications and product descriptions at any time, without notice. Intel Corporation may have patents or pending patent applications, trademarks, copyrights, or other intellectual property rights that relate to the presented subject matter. The furnishing of documents and other materials and information does not provide any license, express or implied, by estoppel or otherwise, to any such patents, trademarks, copyrights, or other intellectual property rights. Designers must not rely on the absence or characteristics of any features or instructions marked “reserved” or “undefined.” Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. Intel processor numbers are not a measure of performance. Processor numbers differentiate features within each processor family, not across different processor families.
    [Show full text]