The Community for Technology Leaders
2018 IEEE Symposium on Security and Privacy (SP) (2018)
San Francisco, CA, US
May 21, 2018 to May 23, 2018
ISSN: 2375-1207
ISBN: 978-1-5386-4353-2
pp: 357-372
Pietro Frigo , Vrije Universiteit Amsterdam
Cristiano Giuffrida , Vrije Universiteit Amsterdam
Herbert Bos , Vrije Universiteit Amsterdam
Kaveh Razavi , Vrije Universiteit Amsterdam
Dark silicon is pushing processor vendors to add more specialized units such as accelerators to commodity pro- cessor chips. Unfortunately this is done without enough care to security. In this paper we look at the security implications of integrated Graphical Processor Units (GPUs) found in almost all mobile processors. We demonstrate that GPUs, already widely employed to accelerate a variety of benign applications such as image rendering, can also be used to "accelerate" microarchitectural attacks (i.e., making them more effective) on commodity platforms. In particular, we show that an attacker can build all the necessary primitives for performing effective GPU-based microarchitectural attacks and that these primitives are all exposed to the web through standardized browser ex- tensions, allowing side-channel and Rowhammer attacks from JavaScript. These attacks bypass state-of-the-art mitigations and advance existing CPU-based attacks: we show the first end-to- end microarchitectural compromise of a browser running on a mobile phone in under two minutes by orchestrating our GPU primitives. While powerful, these GPU primitives are not easy to implement due to undocumented hardware features. We describe novel reverse engineering techniques for peeking into the previously unknown cache architecture and replacement policy of the Adreno 330, an integrated GPU found in many common mobile platforms. This information is necessary when building shader programs implementing our GPU primitives. We conclude by discussing mitigations against GPU-enabled attackers.
Integrated-GPUs, Microarchitectural-attacks, Side-channels, Rowhammer, Mobile-security, ARM, Browser-security

P. Frigo, C. Giuffrida, H. Bos and K. Razavi, "Grand Pwning Unit: Accelerating Microarchitectural Attacks with the GPU," 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, US, , pp. 357-372.
253 ms
(Ver 3.3 (11022016))