期刊
2012 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP)
卷 -, 期 -, 页码 143-157出版社
IEEE
DOI: 10.1109/SP.2012.19
关键词
-
资金
- Direct For Computer & Info Scie & Enginr
- Division Of Computer and Network Systems [0905602] Funding Source: National Science Foundation
- Direct For Computer & Info Scie & Enginr
- Division Of Computer and Network Systems [0746888] Funding Source: National Science Foundation
We describe a new side-channel attack. By tracking changes in the application's memory footprint, a concurrent process belonging to a different user can learn its secrets. Using Web browsers as the target, we show how an unprivileged, local attack process-for example, a malicious Android app-can infer which page the user is browsing, as well as finer-grained information: whether she is a paid customer, her interests, etc. This attack is an instance of a broader problem. Many isolation mechanisms in modern systems reveal accounting information about program execution, such as memory usage and CPU scheduling statistics. If temporal changes in this public information are correlated with the program's secrets, they can lead to a privacy breach. To illustrate the pervasiveness of this problem, we show how to exploit scheduling statistics for keystroke sniffing in Linux and Android, and how to combine scheduling statistics with the dynamics of memory usage for more accurate adversarial inference of browsing behavior.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据