Source-linked AI summary
ARMageddon: Cache Attacks on Mobile Devices
Moritz Lipp, Daniel Gruss, Raphael Spreitzer, Clémentine Maurice, Stefan Mangard
TL;DR
Modern smartphones use ARM processors whose cache organization and instruction set had prevented demonstrated cross-core cache attacks on non-rooted Android devices. This paper develops techniques for Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush without privileges, then applies them to covert channels, user-input monitoring, cryptography, and TrustZone cache activity.
Problem
Cross-core cache attacks had not been demonstrated on non-rooted Android smartphones despite powerful techniques on Intel systems, leaving ARM's differing architecture an unresolved gap.
Method
The paper systematically addresses ARM cache, coherence, eviction, replacement-policy, and timing challenges to perform cross-core and cross-CPU attacks without privileges.
Results
The attacks enable Android covert channels, monitoring of taps, swipes, keystrokes, and inter-keystroke timings, and attacks on cryptographic implementations across CPUs.
Takeaways & Limitations
The techniques broaden cache-side-channel attacks to hundreds of millions of off-the-shelf smartphones and reveal information leaks beyond the paper’s example attacks.
Takeaways & Limitations
Real-world exploitation may require an offline cache-template phase or privileged access to trigger events for template collection, although exploiting collected templates requires neither.
Abstract
from arXiv · showhide
In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing attention among the scientific community and powerful techniques to exploit cache side channels have been developed. However, modern smartphones use one or more multi-core ARM CPUs that have a different cache organization and instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have been demonstrated on non-rooted Android smartphones. In this work, we demonstrate how to solve key challenges to perform the most powerful cross-core cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on non-rooted ARM-based devices without any privileges. Based on our techniques, we demonstrate covert channels that outperform state-of-the-art covert channels on Android by several orders of magnitude. Moreover, we present attacks to monitor tap and swipe events as well as keystrokes, and even derive the lengths of words entered on the touchscreen. Eventually, we are the first to attack cryptographic primitives implemented in Java. Our attacks work across CPUs and can even monitor cache activity in the ARM TrustZone from the normal world. The techniques we present can be used to attack hundreds of millions of Android devices.
1 Introduction
The paper demonstrates powerful cross-core and cross-CPU cache attacks on unmodified, non-rooted ARM-based smartphones. These techniques enable high-performance covert channels and fine-grained monitoring of user input and cryptographic activity.
- Research gap: Cross-core cache attacks were previously not demonstrated on smartphones because ARM differs from Intel in instruction set, cache organization, and multi-core architecture.Prior mobile work included AES T-table and same-core timing attacks, while Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush had not been applied on smartphones.
- Technical challenges: The authors solve ARM-specific challenges involving non-inclusive caches, separate CPU caches, missing flush instructions, and pseudo-random replacement policies.Their approach uses coherence and L1-to-L2 transfers, remote-cache-line timing, systematic eviction-strategy analysis, and techniques for predicting replacement behavior.
- Attacks: The demonstrated attacks include Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush across cores and CPUs on off-the-shelf ARM devices.They work against both instruction-inclusive and data-inclusive caches and instruction-non-inclusive, data-inclusive caches.
- Covert channels: The cache-based covert channel outperforms existing Android covert channels by several orders of magnitude.The contribution is stated as a cross-core and cross-CPU result on ARM-based devices.
- Applications: The techniques support monitoring keystrokes, taps, and swipes, and attacking cryptographic implementations, including Java-based primitives.The paper also presents attacks on cryptographic implementations used in practice and discusses observing cryptographic computation in TrustZone.
2 Background and Related Work
This section introduces cache organization, coherence, shared memory, ARM test platforms, and prior cache attacks. It explains why Intel techniques were considered unsuitable for smartphones and summarizes the attack primitives later adapted to ARM.
- CPU Caches: Caches reduce memory-access latency by storing frequently used data in small, fast memories, organized into sets whose congruent addresses compete for cache lines.Replacement policies determine which line is evicted; ARM L2 caches commonly use an undocumented pseudo-random policy in practice.
- CPU Caches: ARM processors typically use two cache levels, whose relationship may be inclusive, exclusive, or non-inclusive; their last-level cache organization matters for cross-core attacks.A non-inclusive cache need not duplicate lower-level lines in the last-level cache.
- Coherence and Devices: Cache coherence protocols maintain consistency across cores and CPUs while introducing timing effects that attackers can exploit.The tested smartphones use shared L2 caches and coherence between cores; the Samsung Galaxy S6 also has coherence between its two CPUs.
- Shared Memory: Read-only shared libraries let an attacker map the same physical memory as a victim, while Android Runtime compiles Java bytecode into shareable native binaries.These mechanisms provide shared code or data suitable for fine-grained cache monitoring.
- Cache Attacks: Evict+Time and Prime+Probe identify accessed cache sets, while Flush+Reload identifies specific victim instructions or data through shared binaries.Evict+Reload replaces flushing with eviction, and Flush+Flush uses flush timing without performing a memory access.
- Cache Attacks: Before this work, smartphone cache attacks were limited mainly to same-core or less efficient timing attacks because cross-core methods were considered incompatible with ARM.Prior studies confirmed timing leakage on ARM devices but reported difficulty caused by noise.
3 ARMageddon Attack Techniques
ARMageddon adapts cache attacks to heterogeneous, non-rooted ARM smartphones by overcoming non-inclusive caches, missing flush instructions, pseudo-random replacement, and unprivileged timing constraints. The resulting techniques distinguish cross-core cache activity and support practical attacks across cores and CPUs.
- Threat model: The attacker operates from an unprivileged, permissionless application on stock or customized Android without requiring a rooted device.The techniques do not exploit specific Android-version vulnerabilities.
- Defeating the Cache Organization: Coherence protocols and L1-to-L2 transfers enable cross-core attacks despite non-inclusive shared last-level caches and varying cache organizations.Remote-core fetches are faster than main-memory accesses, providing a timing distinction for cache hits and misses.
- Defeating the Cache Organization: On the OnePlus One, cross-core accesses add 40 CPU cycles on average, whereas cache misses take more than 500 CPU cycles, making them distinguishable with one threshold.The distinction follows from cache coherence and faster remote-core fetches.
- Fast Cache Eviction: Automated analysis of more than 4 200 eviction strategies identifies reproducible, lower-overhead strategies for ARM caches with pseudo-random replacement.The method uses physically congruent addresses and can compute eviction sets through mappings accessible to unprivileged Android applications.
- Fast Cache Eviction: On the Krait 400, strategy N = 11, A = 2, D = 2 achieves a 100% average eviction rate in 1578 CPU cycles.The privileged flush instruction also reaches a 100% average eviction rate in 549 CPU cycles, but is unavailable on the other devices.
- Fast Cache Eviction: On the Cortex-A53, strategy N = 21, A = 1, D = 6 achieves 99.93% average eviction in 4275 CPU cycles, while LRU eviction takes 28 times more cycles for 99.10%.Reaccessing data already in L2 and gradually adding addresses is more suitable for the last-level cache than accessing many different addresses.
- Accurate Unprivileged Timing: Four timing methods, including perf_event_open and clock_gettime(), clearly distinguish cache hits from misses on the Alcatel One Touch Pop 2 despite latency and noise.The best timing method can be selected online within a few seconds, and perf_event_open requires no privileges or permissions when supported by the kernel.
4 High Performance Covert Channels
The paper builds high-performance covert channels between unprivileged Android applications by communicating through cache state in shared libraries. These channels operate across cores and CPUs and substantially outperform prior Android covert channels.
- Cache hits and misses remain clearly distinguishable with all evaluated timing methods on the Alcatel One Touch Pop 2.The best timing method can be selected online within a few seconds despite latency and noise.
- The covert channel uses shared-library addresses that the sender loads into or evicts from the cache, allowing the receiver to observe cache hits or misses.Both processes have read-only access to the shared library; packets include data, sequence numbers, checksums, and acknowledgements.
- 1 140 650 bps at 1.10% error achieves a Samsung Galaxy S6 cross-core transmission rate 265 times faster than previous smartphone covert channels.The same device reaches 257 509 bps at 1.83% error across CPUs.
- 178 292 bps at 0.48% error is achieved with Flush+Flush for cross-core transmission on the Samsung Galaxy S6.
- 13 618 bps at 3.79% error is achieved on the Alcatel One Touch Pop 2 using Evict+Reload, three times faster than previous smartphone covert channels.On the older OnePlus One, the channel reaches 12 537 bps at a 5.00% error rate, also three times faster than previous covert channels.
5 Attacking User Input on Smartphones
The paper applies cache-template attacks to infer touchscreen and keyboard activity on Android smartphones. It distinguishes taps, swipes, and key presses, and derives swipe or entered-word lengths without requiring privileges for exploitation.
- Cache-template attacks: Cache-template attacks profile event-specific cache hits in a matrix, then use the matrix to infer events during exploitation.The attacks use Evict+Reload or Flush+Reload against shared binaries or libraries.
- Attack requirements: Exploitation requires neither privileged access nor permissions, although triggering events for profiling may require an offline phase or privileged access.
- Touchscreen events: Address 0x11040 in libinput.so distinguishes taps from swipes on the Alcatel One Touch Pop 2, with swipes producing more frequent cache hits.The Samsung Galaxy S6 and OnePlus One experiments likewise monitor individual tap and swipe events and estimate swipe length.
- Touchscreen events: Swipe-length measurements can be correlated with word length and can reveal the length of Android unlock patterns.
- Keyboard input: Addresses in the default AOSP keyboard executable monitor key presses and distinguish keyboard taps from generic touch actions.An address activated by letters but rarely by space or return enables determining the length of words entered with the default keyboard.
- Broader applicability: The generic cache-template technique can target other shared libraries to monitor events from components such as GPS, Bluetooth, cameras, and media decoders.The paper states that recorded activity can reveal more about users over time.
- Discussion and impact: Inter-keystroke timing is sub-microsecond accurate and can identify exact touch timing and whether input occurred on the soft keyboard.This information can improve sensor-based keyloggers that otherwise lack precise touch timing and location.
- Discussion and impact: Just-in-time compilation prevents Evict+Reload and Flush+Reload against shared Dalvik code, while Prime+Probe still works on ART binaries and JIT-compiled Dalvik code.
6 Attack on Cryptographic Algorithms
The paper demonstrates practical cross-core cache attacks against Android cryptographic implementations and shows that cache activity in ARM TrustZone can be observed from the normal world.
- AES T-Table Attacks: The attacks target AES T-table implementations in Bouncy Castle, including Java cryptographic code used on Android devices.Bouncy Castle 1.5 employs AES T-tables by default, leaving devices using that version vulnerable.
- AES T-Table Attacks: Flush+Reload and Evict+Reload remain effective when shared memory is available, while Prime+Probe enables cross-core attacks without shared memory.The Prime+Probe attack applies to private or dynamically generated victim memory and supports a real-world scenario.
- AES T-Table Attacks: 256–512 encryptions reduce the key space to 64 bits by revealing the upper 4 bits of a key byte through a first-round template attack.The attack monitors a single address for each plaintext-byte and key combination.
- AES T-Table Attacks: 3707 encryptions can enable full key recovery by exploiting disaligned T-tables and monitoring a single address during each encryption.The expected number of encryptions to identify a key byte is 1.81 · 128, multiplied across 16 bytes.
- AES T-Table Attacks: 3 times as many measurements are required by Prime+Probe as by Evict+Reload to achieve the same accuracy.Prime+Probe nevertheless produces a cache template that reveals key information.
- Spy on TrustZone Code Execution: Prime+Probe distinguishes valid from invalid TrustZone keys, showing that TrustZone isolation does not protect against cache attacks from the normal world.On the Samsung Galaxy S6, repeated parallel probing works despite cache flushing when entering or leaving the trusted world.
7 Countermeasures
The paper identifies software and hardware countermeasures that can reduce cache attacks, while noting trade-offs and the importance of restricting supporting system information.
- Software Countermeasures: Restricting access to /proc/pid/pagemap can impede attacks that resolve virtual addresses to physical addresses.The authors use this information to facilitate cache attacks on Android.
- Software Countermeasures: Restricting shared-library, dex, and art-binary files to their owners can prevent Evict+Reload, Flush+Reload, and Flush+Flush attacks through shared files.The recommendation targets files that remain readable by arbitrary processes or applications.
- Cryptographic Countermeasures: Hardware AES instructions should replace AES T-tables; otherwise, software-only bit-sliced implementations are recommended, especially when table disalignment is possible.The paper also identifies cache partitioning as a possible defense, but it has performance costs and cannot prevent all attacks.
- Deployment: Google applied upstream patches preventing access to /proc/pid/pagemap in early 2016 and recommended the security update in March 2016.The authors had disclosed the attacks and countermeasures before publication.
8 Conclusion
The work establishes privilege-free cross-core and cross-CPU cache attacks on unmodified Android smartphones, extending them to user input, Java cryptography, and ARM TrustZone activity.
- Main Findings: The demonstrated attacks require no permissions or privileges and work across cores and CPUs on ARM-based Android devices.The techniques address challenges caused by ARM cache organization and instruction-set differences.
- Main Findings: High-resolution measurements enable monitoring of touch actions, soft-keyboard activity, and inter-keystroke timings.The paper reports that these measurements can support inference of entered words and touchscreen word lengths.
- Main Findings: The attacks recover information from the default Java Bouncy Castle AES implementation and monitor cache activity inside ARM TrustZone from the normal world.These examples demonstrate applicability beyond conventional native cryptographic targets.
- Impact: The techniques may affect hundreds of millions of off-the-shelf smartphones with similar or identical hardware.The authors state that the example attacks are not exhaustive and that other libraries and apps may expose further information leaks.