Over the past week, I have been talking about a new, non-Spectre side-channel attack called “Spoiler”. Thanks to our partner SonicWall, here is a breakdown of how it was discovered, how it attacks, and how to stop it!
What is Spoiler?
Research from the Worcester Polytechnic Institute in Worcester, Mass., and the University of Lübeck in Germany, identifies a new “microarchitectural leakage stemming from the false dependency hazards during speculative load operations.”
The group’s paper, “SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks,” proposes the new side-channel Spoiler attack, which could exploit a “previously unknown microarchitectural leakage stemming from the false dependency hazards during speculative load operations.”
As a result, Spoiler also enhances the effectiveness of other side-channel attacks, namely Rowhammer, and other cache-based attacks. The report notes that Spoiler only affects Intel Core processors and not current AMD and ARM processors.
The research group was quick to point out that while Spoiler is similar to Spectre, they aren’t the same and have very different ramifications, namely with how previous attacks take advantage of vulnerabilities in the speculative branch prediction unit and memory leaks in protected environments.
“Spoiler is not a Spectre attack,” the researchers published in their 17-page report. “The root cause for Spoiler is a weakness in the address speculation of Intel’s proprietary implementation of the memory subsystem, which directly leaks timing behavior due to physical address conflicts. Existing Spectre mitigations would therefore not interfere with Spoiler.”
Stop Spoiler Side-Channel Attacks with RTDMI
SonicWall’s Real-Time Deep Memory Inspection (RTDMI) isn’t a common mitigation solution. But, like it does with Spectre, Meltdown, Foreshadow and PortSmash, SonicWall’s RTDMI can mitigate Spoiler attacks.
RTDMI provides CPU-level instruction detection granularity (unlike typical behavior-based systems, which have only API/system call-level granularity) to detect malware variants that contain exploit code targeting processor vulnerabilities, including Spoiler.
To discover packed malware code that has been compressed to avoid detection, the RTDMI engine allows the malware to reveal itself by unpacking its compressed code in memory in a secure sandbox environment. It sees what code sequences are found within and compares it to what it has already seen.
Identifying malicious code in memory is more precise than trying to differentiate between malware system behavior and clean program system behavior, which is an approach used by some other analysis techniques.
Besides being highly accurate, RTDMI also improves sample analysis time. Since it can detect malicious code or data in memory in real-time during execution, no malicious system behavior is necessary for detection. The presence of malicious code can be identified prior to any malicious behavior taking place, thereby rendering a quicker verdict.
The IT Security experts at RedZone can help you minimize risk with SonicWall’s Real-Time Deep Memory Inspection that can mitigate Spoiler attacks.
For more information, contact my team today: (410) 897-9494 | myteam@redzonetech.net
Source: SonicWall Blog Post, March 6, 2019 – New Spoiler Side-Channel Attack Threatens Processors, Mitigated by SonicWall RTDMI, by Brooke Chelmo.
