PowerHooK: Enabling Software-Based Power Side Channels Against AMD SEV Technologies...
summary
PowerHooK repurposes page-fault-based transient replay so a malicious hypervisor repeatedly re-executes victim code and collects denoised software power traces, turning noisy system power into a side channel. The implementation amplifies leakage enough to recover AES key bytes across AMD SEV, SEV-ES and SEV-SNP; an experimental AES-NI CPA succeeds with 1320 samples on SEV-SNP. A real-world exploit targets OpenSSL CBC and recovers multiple key bytes after a few hours of tracing.
AI-written summary · about
chapters (9)
- 0:00PowerHook research
- 1:55Threat model
- 3:59Measuring power from software
- 5:44Transient execution replay
- 7:48Leakage analysis overview
- 10:39AMD SEV execution time
- 11:24Synthetic AES CPA
- 13:28AES-CBC decryption attack
- 15:40Results and conclusion
related talks
36mCollide+Power: The Evolution of Software-based Power Side-Channels Attacks
51mExploiting Hardware Glitches And Side Channels In Perfect Software
49mBreaking Hardware-Enforced Security With Hypervisors
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
28mComplexity Killed Security
24mThe Memory of a Meltdown
13mExploiting Inaccurate Branch History in Side-Channel Attacks