DUPEFS: Leaking Data Over the Network With Filesystem Deduplication Side Channels
summary
Shows a practical remote channel against ZFS inline deduplication that leaks OAuth access tokens from an nginx access log by exploiting timing differences during transactional flushes. Attack builds a timed-write primitive plus alignment probing and secret spraying to amplify the signal, achieves ~1 byte per 40 minutes on LAN (~1.5 bytes/hour) and ~1 byte/hour remotely, 92–94% per-byte success with ~10 GB IO and ~21 hours to recover a 22-byte token. Mitigation: a pseudo same-behavior write policy that removes the timing signal.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:33Timing Side Channel
- 2:35Threat Model
- 3:45Challenges
- 5:00Techniques
- 8:49Workflow
- 11:31Evaluation
- 13:38Mitigation
- 14:15Conclusion
related talks
31mRemote Memory-Deduplication Attacks
20mSecure and Lightweight Deduplicated Storage via Shielded Deduplication...
47mDenial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
48mHTTP Desync Attacks: Request Smuggling Reborn
50mHTTP Desync Attacks: Smashing into the Cell Next Door
19mPrefix Siphoning: Exploiting LSM-Tree Range Filters For Information Disclosure
25mHardening Confidential Federated Computations against Side-Channel Attacks
45mHTTP Desync Attacks: Smashing Into The Cell Next Door