MASCAT: Stopping Microarchitectural Attacks Before Execution Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar Worcester Polytechnic Institute, Worcester, MA, USA fgirazoki,teisenbarth,
[email protected] Abstract. Microarchitectural attacks have gained popularity in recent years since they use only standard resources, e.g. memory and cache ac- cess timing. Such privileges are available to applications at the lowest privilege levels. Further, microarchitectural attacks have proven success- ful on shared cloud instances across VMs, on smartphones with sandbox- ing, and on numerous embedded platforms. Given the rise of malicious code in app stores and in online repositories it becomes essential to scan applications for such stealthy attacks. We present a static code analysis tool, MASCAT , capable of scanning for ever evolving microarchitectural attacks. Our proposed tool MASCAT can be used by app store service providers to perform large scale fully automated analysis of applications. The initial MASCAT suite is built to include attack vectors to cover pop- ular cache/DRAM access attacks and Rowhammer. Further, our tool is easily extensible to cover newer attack vectors as they emerge. Keywords: Microarchitectural attacks, cache attacks, static code analysis. 1 Introduction In recent years the security community has witnessed the rise of microachitec- tural side channel attacks. While only 3 years ago the feasibility of microarchitec- tural attacks was restricted to core private resources, today they are applicable across CPU cores and even across CPU sockets. Furthermore, new sophisti- cated methodologies are discovered frequently, e.g. memory bus locking attacks or rowhammer attacks, raising concerns among software and hardware security developers. In fact, microarchitectural attacks already provide a wide range of their capabilities.