Bankrupt Covert Channel: Turning Network Predictability into Vulnerability
summary
Bankrupt turns RDMA predictability into a cross-node covert timing channel that steers RDMA reads to a single memory bank on an intermediary and probes contention from a separate node. Prototype uses an iterative address-bit search to find addresses mapping to same bank, tunes burst sizes (32–128 RDMA reads) and probe rate (~2 MHz), hits 74Kb/s throughput in CloudLab’s 200-node public cluster, survives noise by trading burst size, and remains undetectable by CPU/NIC counters.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:26Containing Data Breaches in Public Cloud
- 2:28Network Covert Channels
- 3:10Emerging Networks in Public Cloud
- 6:44Constructing Bankrupt
- 7:46Virtual Memory Addressing
- 8:34Bank Location
- 9:09Same-Bank Addresses Search: Iteration
- 12:01Sender Side
- 12:27Receiver Side
- 13:37Evaluation Platforms
- 14:15Private Cluster: Isolated Environment
- 15:04Private Cluster: Noisy Environment
- 15:46Private Cluster: Stealthiness
- 16:51Private Cluster vs. CloudLab: Throughput & Accuracy
- 18:06Takeaways
related talks
14mUnderstanding RDMA Microarchitecture Resources for Performance Isolation
15mSecuring RDMA for High-Performance Datacenter Storage Systems
25mDRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
01h 24mPreview Session
15mCollie: Finding Performance Anomalies in RDMA Subsystems
12mPreview: Networking
17mHarmonic: Hardware-assisted RDMA Performance Isolation for Public Clouds
23mMulti-Path Transport for RDMA in Datacenters