iTimed: Cache Attacks on the Apple A10 Fusion SoC Gregor Haas, Seetal Potluri, and Aydin Aysu Department of Electrical and Computer Engineering North Carolina State University fghaas, spotlur2,
[email protected] Abstract—This paper proposes the first cache timing side- devices which cannot be obtained legally [8]. Additionally, channel attack on one of Apple’s mobile devices. Utilizing Apple ensures that applications cannot arbitrarily interact a recent, permanent exploit named checkm8, we reverse- with other applications or the operating system by strictly engineered Apple’s BootROM and created a powerful toolkit for running arbitrary hardware security experiments on Ap- enforcing the allowed inter-process communication (IPC) ple’s in-house designed ARM systems-on-a-chip (SoC). Using interfaces. As shown in the literature [9], even determining this toolkit, we then implement an access-driven cache timing which interfaces exist is a challenging research problem. attack (in the style of PRIME+PROBE) as a proof-of-concept In the context of hardware security research on iPhones, illustrator. useful resources such as documentation or development The advanced hardware control enabled by our toolkit allowed us to reverse-engineer key microarchitectural details tools are even rarer than for software security research. For of the Apple A10 Fusion’s memory hierarchy. We find that the one, Apple does not release any detailed documentation SoC employs a randomized cache-line replacement policy as for their in-house designed hardware modules. Some in- well as a hardware-based L1 prefetcher. We propose statistical formation can be found in Apple’s patents for a dynamic innovations which specifically account for these hardware voltage frequency modulation (DVFM) module [10], secure structures and thus further the state-of-the-art in cache timing attacks.