Spectector: Principled detection of speculative information flows

M Guarnieri, B Köpf, JF Morales… - … IEEE Symposium on …, 2020 - ieeexplore.ieee.org
Since the advent of Spectre, a number of counter-measures have been proposed and
deployed. Rigorously reasoning about their effectiveness, however, requires a well-defined …

Binsec/rel: Efficient relational symbolic execution for constant-time at binary-level

LA Daniel, S Bardin, T Rezk - 2020 IEEE Symposium on …, 2020 - ieeexplore.ieee.org
The constant-time programming discipline (CT) is an efficient countermeasure against timing
side-channel attacks, requiring the control flow and the memory accesses to be independent …

Casa: End-to-end quantitative security analysis of randomly mapped caches

T Bourgeat, J Drean, Y Yang, L Tsai… - 2020 53rd Annual …, 2020 - ieeexplore.ieee.org
It is well known that there are micro-architectural vulnerabilities that enable an attacker to
use caches to exfiltrate secrets from a victim. These vulnerabilities exploit the fact that the …

Composable Cachelets: Protecting Enclaves from Cache {Side-Channel} Attacks

D Townley, K Arıkan, YD Liu, D Ponomarev… - 31st USENIX Security …, 2022 - usenix.org
The security of isolated execution architectures such as Intel SGX has been significantly
threatened by the recent emergence of side-channel attacks. Cache side-channel attacks …

Hunting the haunter-efficient relational symbolic execution for spectre with haunted relse

LA Daniel, S Bardin, T Rezk - NDSS 2021-Network and Distributed …, 2021 - inria.hal.science
Spectre are microarchitectural attacks which were made public in January 2018. They allow
an attacker to recover secrets by exploiting speculations. Detection of Spectre is particularly …

SpecuSym: Speculative symbolic execution for cache timing leak detection

S Guo, Y Chen, P Li, Y Cheng, H Wang, M Wu… - Proceedings of the ACM …, 2020 - dl.acm.org
CPU cache is a limited but crucial storage component in modern processors, whereas the
cache timing side-channel may inadvertently leak information through the physically …

Microwalk-ci: practical side-channel analysis for javascript applications

J Wichelmann, F Sieck, A Pätschke… - Proceedings of the 2022 …, 2022 - dl.acm.org
Secret-dependent timing behavior in cryptographic implementations has resulted in
exploitable vulnerabilities, undermining their security. Over the years, numerous tools to …

{ARCUS}: symbolic root cause analysis of exploits in production systems

C Yagemann, M Pruett, SP Chung, K Bittick… - 30th USENIX Security …, 2021 - usenix.org
End-host runtime monitors (eg, CFI, system call IDS) flag processes in response to
symptoms of a possible attack. Unfortunately, the symptom (eg, invalid control transfer) may …

KLEESpectre: Detecting information leakage through speculative cache attacks via symbolic execution

G Wang, S Chattopadhyay, AK Biswas, T Mitra… - ACM Transactions on …, 2020 - dl.acm.org
Spectre-style attacks disclosed in early 2018 expose data leakage scenarios via cache side
channels. Specifically, speculatively executed paths due to branch mis-prediction may bring …

Speculation at Fault: Modeling and Testing Microarchitectural Leakage of {CPU} Exceptions

J Hofmann, E Vannacci, C Fournet, B Köpf… - 32nd USENIX Security …, 2023 - usenix.org
Microarchitectural leakage models provide effective tools to prevent vulnerabilities such as
Spectre and Meltdown via secure co-design: For software, they provide a foundation for …