Title
CacheLight: Defeating the CacheKit Attack.
Abstract
To protect software systems from attacks, ARM introduced a hardware security extension known as TrustZone. TrustZone provides an isolated execution environment, which can be used to deploy various memory integrity and malware detection tools. However, a new type of rootkit, namely CacheKit, can exploit cache incoherency and cache locking mechanisms in TrustZone to hide itself from such inspections. Therefore, it is imperative to design a new approach to ensure the correct use of cache locking and prevent malicious code from being hidden in the cache. In this paper, we present CacheLight, which leverages the TrustZone and Virtualization extensions of the ARM architecture to allow the system to continue to securely provide these hardware facilities to users while preventing attackers from exploiting them. CacheLight restricts the ability to lock the cache to the Secure World of the processor such that the Normal World can still request certain memory to be locked into the cache by the secure operating system (OS) through a Secure Monitor Call (SMC). This grants the secure OS the power to verify and validate the information that will be locked in the requested cache way thereby ensuring that any data that remains in the cache will not be inconsistent with what exists in main memory for inspection. Malicious attempts to hide data can be prevented and recovered for analysis while legitimate requests can still generate valid entries in the cache.
Year
DOI
Venue
2018
10.1145/3266444.3266449
ASHES@CCS
Keywords
Field
DocType
Hardware Assisted Security, TrustZone, Embedded Systems Security, Rootkit Defense, Cache Locking
Virtualization,ARM architecture,Hardware security module,Computer science,Cache,Computer security,Rootkit,Exploit,Software system,Malware
Conference
ISBN
Citations 
PageRank 
978-1-4503-5996-2
0
0.34
References 
Authors
7
5
Name
Order
Citations
PageRank
Mauricio Gutierrez100.34
Ziming Zhao232230.52
Adam Doupé335733.14
Yan Shoshitaishvili435826.98
Gail-Joon Ahn53012203.39