Suman Jana and Vitaly Shmatikov The University of Texas at Austin Memento: Learning Secrets from Process Footprints 33 rd Security & Privacy (May, 2012) Best student paper award This slide is modified from

Outline 2012/05/28 A Seminar at Advanced Defense Lab 2 Introduction Side channels through /proc Memento Implementation Evaluation Variations of the attack Solutions? Summary

Introduction 2012/05/28 A Seminar at Advanced Defense Lab 3 Implementing whole security mechanism at user mode is very difficult.

Trends in software design Applications rely on OS abstractions to improve their safety and reliability “Process” “User” Case study: Web browsers Fork a new process OS isolation Fork a new process /05/28

Unintended consequences Good Better isolation Better reliability Others not affected if one process crashes Better safety Bad Leaks more info to concurrent processes Topic of this talk /05/28 A Seminar at Advanced Defense Lab

ProcFS: Process info in multi-user OS ps top –p 1 introduced in the 1980s Tom Killian "Processes as Files" (1984) cat /proc/1/st atus 6

What can one learn from ProcFS? IP addrs of websites other users are visiting 7 A Seminar at Advanced Defense Lab 2012/05/28

Side channels through /proc "Peeping Tom in the Neighborhood: Keystroke Eavesdropping on Multi-User Systems" - Usenix Security 2009 o Keystroke timing leak through ESP/EIP values from /proc/ /stat XiaoFeng WangKehuan Zhang 8 A Seminar at Advanced Defense Lab 2012/05/28

The story of "Peeping Tom" NDSS '09 program committee: "Nobody uses multi-user computers anymore" Shout-out to XiaoFeng ;) 9 A Seminar at Advanced Defense Lab 2012/05/28

The story of "Peeping Tom" Oakland '09 program committee: "Nobody uses multi-user computers anymore" Shout-out to XiaoFeng ;) 10 A Seminar at Advanced Defense Lab 2012/05/28

Nobody uses multi-user computers anymore??? 11 A Seminar at Advanced Defense Lab 2012/05/28

Android sandboxing = UNIX multi-user isolation ps top –p 1 UNIX multi-users in the 1980s cat /proc/1/st atus 12 A Seminar at Advanced Defense Lab 2012/05/28

Android sandboxing = UNIX multi-user isolation ps top –p 1 Android “multi-users” in 2012 cat /proc/1/st atus 13 A Seminar at Advanced Defense Lab 2012/05/28

Android sandboxing = UNIX multi-user isolation Different apps run as different users Android uses OS “user” abstraction to isolate applications /05/28

Android “multi-users” in 2012 cat /proc/1/st atus Android sandboxing = UNIX multi-user isolation ps top –p 1 ProcFS API is still unchanged!! 15 A Seminar at Advanced Defense Lab 2012/05/28

What can a zero-permission app do? Can read all world-readable files in /proc … but “Peeping Tom” attack does not work  o ESP/EIP too unpredictable - JVM, GUI etc. Introducing “Memento” attacks Works on all major OSs (except iOS) 16 A Seminar at Advanced Defense Lab 2012/05/28

This is not just about Android! 17 A Seminar at Advanced Defense Lab 2012/05/28

Process resource usage = big-time side channel Memory usage leaks inputs and user actions Reveals webpages visited in Chrome, Firefox, Android browser, any WebKit-based browser Reveals state of Web applications Membership in dating sites, specific interests on medical sites, etc. CPU usage leaks keystroke timing For bash, ssh, Android on-screen keyboard handler Yields a better, much more robust “Peeing Tom” Completely new attack! Completely new attack! 18 A Seminar at Advanced Defense Lab 2012/05/28

“Memento” (2000): putting together “memory streams” 19 A Seminar at Advanced Defense Lab 2012/05/28

“Memento” (2000): putting together “memory streams” 20 A Seminar at Advanced Defense Lab 2012/05/28

Memprint: stream of memory usage KB KB KB KB KB KB KB KB KB 21 A Seminar at Advanced Defense Lab 2012/05/28

2050 Sniffing memory footprints zero-permission malicious process OS isolation browser process alloc 1 alloc 2 OS free page pool used page count memprint A Seminar at Advanced Defense Lab 2012/05/28

2056 Sniffing memory footprints zero-permission malicious process OS isolation browser process alloc 1 alloc 2 OS free page pool used page count memprint brk/mmap A Seminar at Advanced Defense Lab 2012/05/28

2080 Sniffing memory footprints zero-permission malicious process OS isolation browser process alloc 1 alloc 2 OS free page pool used page count memprint brk/mmap A Seminar at Advanced Defense Lab 2012/05/28

Memprint for Chrome loading benaughty.com 25 A Seminar at Advanced Defense Lab 2012/05/28

Memprint for Chrome loading benaughty.com 26 A Seminar at Advanced Defense Lab 2012/05/28

Memprint for Chrome loading benaughty.com 27 A Seminar at Advanced Defense Lab 2012/05/28

Full attack OS isolation browser zero-permission app /proc/pid/statm memprint database 28 A Seminar at Advanced Defense Lab 2012/05/28

Implementation 2012/05/28 A Seminar at Advanced Defense Lab 29 Measuring the target’s memory footprint Linux and Anddroid /proc/ /statm  drs (data resident size) [link]link FreeBSD kvm_getprocs [link]link Windows Performance Data Helper (PDH) library [link]link

Environment 2012/05/28 A Seminar at Advanced Defense Lab 30 Chrome Version: Measure the render process Firefox Version: Monolithic browser Using fresh browser Android Version: 2.2 Froyo in the x86 simulator The results are the same for 3.1 Honeycomb in Google’s ARM simulator.

Building the signature database 2012/05/28 A Seminar at Advanced Defense Lab 31 A memprint is a set of (E, c) tuples. E is an integer representing a particular footprint size c is how often it was observed during measurement. Ex: ALEXA TOP 1,000:

Similarity 2012/05/28 A Seminar at Advanced Defense Lab 32

Why the attack works Memprints are unique (for up to 43% of webpages) Can tune recognition to achieve zero false positives Memprints are stable … across repeated visits to the same page memprints are OS/browser- dependent but machine- independent 33

Cross-page similarity for 100 random pages out of Alexa top 1000 Different from others Similar to themselves web page ID similarity = Jaccard index of memprints 34 A Seminar at Advanced Defense Lab

/05/28 A Seminar at Advanced Defense Lab Evaluation Distinguishability A page is distinguishable Distinguishability > 0

/05/28 A Seminar at Advanced Defense Lab 100 random pages, 1,000-page ambiguity set

/05/28 A Seminar at Advanced Defense Lab If the threshold makes no false positive 100 random distinguishable pages

/05/28 A Seminar at Advanced Defense Lab Variations of the attack Only focus changes caused by allocating or de-allocating large images. Inferring the state f Web sessions. Add secondary side channel information Ex : CPU scheduling statistics

Fine-grained info leak: OkCupid is login successful? no yes memory usage increases by 1-2 MB memory usage increases by 1-2 MB is a paid customer ? is a paid customer ? no memory usage increases by MB memory usage increases by MB no new flash player plugin process new flash player plugin process to display ads yes 39 A Seminar at Advanced Defense Lab 2012/05/28

Concurrent processes don't hurt, sometimes make it even better!! 40 A Seminar at Advanced Defense Lab 2012/05/28

Memento attacks: CPU usage info Monitor /proc/ /status for number of context switches Infer inter-keystroke timing for bash, ssh, Android on-screen keyboard handler etc. o Processing each keystroke requires a predictable number of context switches o Keystroke processing time << keystroke interval sufficient to reconstruct typed text [Zhang and Wang] /05/28

Keystroke timing (Android MMS app) 42 A Seminar at Advanced Defense Lab 2012/05/28

Solutions? Increasing reliance on OS isolation makes these attacks easier OS problem, not an application problem Disable /proc o FreeBSD: no /proc, but attacker can still measure victim's memory footprint via kvm_getprocs Stop reporting fine-grained resource usage across “user” boundary Only report info for user's own processes Breaks tools like ps, top etc. 43 A Seminar at Advanced Defense Lab 2012/05/28

does NOT need the API needed the API Summary Process info API o A legacy of the 1980s o Reveals process's resource usage - CPU, mem, netw o A single measurement is harmless (most of the time) o Dynamics of processes’ resource usage = high-bandwidth side channel Memento attacks o OS designers must rethink process info API /05/28