Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
This lab consists of three modules:
1. Build a Flush+Reload based cache covert channel.
2. Build a mechanism for exception suppression.
3. Implement a Meltdown attack and steal the secret from our course workstation at
10.75.9.63 (Northeastern VPN required)
2 Using the Course Workstation
1. You will receive an email to your husky email address with the subject “[EECE5699] Lab machine
account ready,” which contains the username and the password. If you could not find it, please check
the spam.
2. Outgoing network traffic is disabled on that machine. To transfer files to it, please use sftp.
3. You are only allowed to run 40 processes at the same time.
4. Please write and debug your code on your local machine because the workstation has limited resources.
Testing of your covert-channel should also be done on your machine. Only use the workstation for
the “Stealing Secret” testing as the course workstation is using an obsolete Linux kernel that is still
vulnerable to Meltdown.
5. Please back up your files to your local machine. The course workstation may be cleaned up at any
time.
3 Accept your Assignment on Github
Please click the following link to accept this assignment: https://classroom.github.com/a/zoeG6G5E
14 Building a Covert-Channel (30 pts)
A covert-channel is built on top of a side-channel - shared microarchitecture. The sender encodes the data
into the microarchitecture state, and the receiver decodes the data from the state. In this lab, you will build
an in-process covert-channel using the Flush+Reload technique, where the sender and receiver are in the
same process. An in-process covert-channel is much easier to implement than a cross-process covert channel
and is sufficient for the Meltdown attack.
You are already familiar with F+R side-channel attack from the previous lab, where there is a victim
execution between F and R operations, and the F+R attack determines whether the victim has accessed a
memory address or not (brought back to the cache). We now use the F+R technique in a slightly different
way to build a covert-channel for transmitting data.
Suppose the data you would like to transmit is 8 bits, there are 256 possible values (0 to 255) for it. You
can allocate an array of 256 memory spaces (each at least of a cache line size). The covert-channel is done
in three steps. First for presetting, a series of Flush operations flush all the 256 elements in the array one by
one. Then for data transmission (encoding it in the cache), use the 8-bitt secret data as an index to access
one of of the 256 memory locations. Last for receiving, the Reload operation (receiver) is to re-access the
256 memory locations one by one and time them. The memory location with a shorter access time (lower
than the threshold that separates cache hit and cache miss) indicates the value transmitted (the index of
the memory location in the array).
The listing below shows an example for transmitting value 4 via the cache covert-channel. A UserArray
consists of 256 spaces where space is set at the size of a memory page (4K bytes). The steps for building a
covert-channel are:
1. Set the cache state - first flush 256 memory elements of UserArray out of caches.
2. Transmit data - the sender encodes the data into the cache state by accessing UserArray[4 *space].
With this access, the cache state changes to the 4th memory block are kept in the cache while all others
are not.
3. Receive data - the receiver decodes the cache state by reloading UserArray[i * space] for i = 0 to 255
and time the reload. When you see a cache hit (lower timing), the i is the data value transmitted.