Add more tools from paper.

_tools/ABSynthe.md

@@ -0,0 +1,49 @@
+---
+slug: absynthe
+title: ABSynthe
+description: "ABSynthe: Automatic blackbox side-channel synthesis on commodity microarchitectures."
+year: 2020
+target: Binary
+technique: Dynamic
+guarantees: other
+available: true
+repo: https://github.com/vusec/absynthe
+papers:
+ - name: "ABSynthe: Automatic blackbox side-channel synthesis on commodity microarchitectures."
+   link: https://www.ndss-symposium.org/ndss-paper/absynthe-automatic-blackbox-side-channel-synthesis-on-commodity-microarchitectures/
+---
+
+![GitHub last commit](https://img.shields.io/github/last-commit/vusec/absynthe)![GitHub contributors](https://img.shields.io/github/contributors/vusec/absynthe)![GitHub Repo stars](https://img.shields.io/github/stars/vusec/absynthe)
+
+## Abstract
+
+The past decade has seen a plethora of side channel attacks on various CPU components.
+Each new attack typically follows a whitebox analysis approach, which involves (i)
+identifying a specific shared CPU component, (ii) reversing its behavior on a specific
+microarchitecture, and (iii) surgically exploiting such knowledge to leak information
+(e.g., by actively evicting shared entries to monitor victim accesses). This approach
+requires a deep understanding of the target component, obtained by lengthy reverse
+engineering which needs to be repeated for each new component and each microarchitecture.
+It also does not allow for attacking shared resources that are unknown.
+
+In this paper, we present ABSynthe, a system that takes a target program and a
+microarchitecture as inputs and automatically synthesizes new side channels. The key
+insight is that by limiting ourselves to (typically on-core) contention-based side
+channels, we can treat the target CPU microarchitecture as a black box, enabling
+automation. To make ABSynthe possible, we have automatically generated leakage maps
+for a variety of x86_64 microarchitectures. These leakage maps show a complex picture
+and justify a black box approach to finding the best sequence of instructions to cause
+information to leak from a software target. This target is also treated and analyzed
+as a blackbox, to find secret-dependent branches. To recover the secret information
+using the optimized sequence of instructions, ABSynthe relies on a recurrent neural
+network to craft practical side-channel attacks. Our evaluation, somewhat counter-intuitively,
+shows that ABSynthe can synthesize better attacks by exploiting contention on multiple
+components at the same time compared to state of the art contention-based attacks
+that focus on a single component. Concretely, the automation made possible by ABSynthe
+allows us to synthesize cross-thread attacks in different settings and for a variety
+of microarchitectures and cryptographic software targets, in both native and virtualized environments.
+
+We present results for Intel, AMD and ARM microarchitetures, and 4 different cryptographic
+targets. As an example, ABSynthe can recover a full 256-bit EdDSA from just a single trace
+capture with 100% success rate on Intel.
+

_tools/CacheAudit2.md

@@ -0,0 +1,30 @@
+---
+slug: cacheaudit2
+title: CacheAudit2
+description: "Rigorous analysis of software countermeasures against cache attacks"
+year: 2017
+target: Binary
+technique: Formal
+guarantees: other
+available: true
+repo: https://github.com/cacheaudit/cacheaudit/tree/fine-trace
+site: https://software.imdea.org/projects/cacheaudit/memory-trace/
+papers:
+ - name: "Rigorous analysis of software countermeasures against cache attacks"
+   link: https://dl.acm.org/doi/10.1145/3062341.3062388
+---
+
+## Abstract
+
+CPU caches introduce variations into the execution time of programs that can be 
+xploited by adversaries to recover private information about users or cryptographic keys.
+
+Establishing the security of countermeasures against this threat often requires
+intricate reasoning about the interactions of program code, memory layout, and
+hardware architecture and has so far only been done for restricted cases.
+
+In this paper we devise novel techniques that provide support for bit-level and
+arithmetic reasoning about memory accesses in the presence of dynamic memory
+allocation. These techniques enable us to perform the first rigorous analysis of
+widely deployed software countermeasures against cache attacks on modular exponentiation,
+based on executable code.

_tools/CacheTemplates.md

@@ -0,0 +1,39 @@
+---
+slug: cachetemplates
+title: "Cache Templates"
+description: "Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches"
+year: 2015
+target: Binary
+technique: Statistical
+guarantees: other
+available: true
+repo: https://github.com/IAIK/cache_template_attacks
+papers:
+ - name: "Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches"
+   link: https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/gruss
+
+![GitHub last commit](https://img.shields.io/github/last-commit/IAIK/cache_template_attacks)![GitHub contributors](https://img.shields.io/github/contributors/IAIK/cache_template_attacks)![GitHub Repo stars](https://img.shields.io/github/stars/IAIK/cache_template_attacks)
+
+## Abstract
+
+Recent work on cache attacks has shown that CPU caches represent a powerful source of
+information leakage. However, existing attacks require manual identification of
+vulnerabilities, i.e., data accesses or instruction execution depending on secret
+information. In this paper, we present Cache Template Attacks. This generic attack
+technique allows us to profile and exploit cache-based information leakage of any
+program automatically, without prior knowledge of specific software versions or even
+specific system information. Cache Template Attacks can be executed online on a remote
+system without any prior offline computations or measurements.
+
+Cache Template Attacks consist of two phases. In the profiling phase, we determine
+dependencies between the processing of secret information, e.g., specific key input
+ or private keys of cryptographic primitives, and specific cache accesses. In the
+ exploitation phase, we derive the secret values based on observed cache accesses. We
+ illustrate the power of the presented approach in several attacks, but also in a
+ useful application for developers. Among the presented attacks is the application of
+ Cache Template Attacks to infer keystrokes and—even more severe—the identification
+ of specific keys on Linux and Windows user interfaces. More specifically, for
+ lowercase only passwords, we can reduce the entropy per character from log2(26) = 4:7
+ to 1:4 bits on Linux systems. Furthermore, we perform an automated attack on the
+ T-table-based AES implementation of OpenSSL that is as efficient as state-of-the-art
+ manual cache attacks.

_tools/DifFuzz.md

@@ -0,0 +1,38 @@
+---
+slug: diffuzz
+title: DifFuzz
+description: "DifFuzz: Differential Fuzzing for Side-Channel Analysis"
+year: 2019
+target: Java
+technique: Dynamic
+guarantees: "no"
+available: true
+repo: https://github.com/isstac/diffuzz
+papers:
+ - name: "DifFuzz: Differential Fuzzing for Side-Channel Analysis"
+   link: https://doi.org/10.1109/ICSE.2019.00034
+---
+
+![GitHub last commit](https://img.shields.io/github/last-commit/isstac/diffuzz)![GitHub contributors](https://img.shields.io/github/contributors/isstac/diffuzz)![GitHub Repo stars](https://img.shields.io/github/stars/isstac/diffuzz)
+
+
+## Abstract
+
+Side-channel attacks allow an adversary to uncover secret program
+data by observing the behavior of a program with respect to a resource,
+such as execution time, consumed memory or response size. Side-channel
+vulnerabilities are difficult to reason about as they involve analyzing
+the correlations between resource usage over multiple program paths. We
+present DifFuzz, a fuzzing-based approach for detecting side-channel
+vulnerabilities related to time and space. DifFuzz automatically detects
+these vulnerabilities by analyzing two versions of the program and using
+resource-guided heuristics to find inputs that maximize the difference
+in resource consumption between secret-dependent paths. The methodology
+of DifFuzz is general and can be applied to programs written in any
+language. For this paper, we present an implementation that targets
+analysis of Java programs, and uses and extends the Kelinci and AFL
+fuzzers. We evaluate DifFuzz on a large number of Java programs and
+demonstrate that it can reveal unknown side-channel vulnerabilities in
+popular applications. We also show that DifFuzz compares favorably against
+Blazer and Themis, two state-of-the-art analysis tools for finding
+side-channels in Java programs.

_tools/SKKJH18.md

@@ -0,0 +1,29 @@
+---
+slug: skkjh18
+title: SKKJH18
+description: "Unveiling Hardware-based Data Prefetcher, a Hidden Source of Information Leakage"
+year: 2018
+target: Binary
+technique: Statistical
+guarantees: "no"
+available: false
+papers:
+ - name: "Unveiling Hardware-based Data Prefetcher, a Hidden Source of Information Leakage"
+   link: https://dl.acm.org/doi/10.1145/3243734.3243736
+---
+
+## Abstract
+
+Data prefetching is a hardware-based optimization mechanism used in most of the modern
+microprocessors. It fetches data to the cache before it is needed. In this paper, we
+present a novel microarchitectural attack that exploits the prefetching mechanism. Our
+attack targets Instruction pointer (IP)-based stride prefetching in Intel processors.
+Stride prefetcher detects memory access patterns with a regular stride, which are likely
+to be found in lookup table-based cryptographic implementations. By monitoring the
+prefetching activities near the lookup table, attackers can extract sensitive information
+such as secret keys from victim applications. This kind of leakage from prefetching has
+never been considered in the design of constant time algorithm to prevent side-channel
+attacks. We show the potential of the proposed attack by applying it against the Elliptic
+Curve Diffie-Hellman (ECDH) algorithm built upon the latest version of OpenSSL library.
+To the best of our knowledge, this is the first microarchitectural side-channel attack
+exploiting the hardware prefetching of modern microprocessors.

_tools/STACCO.md

@@ -0,0 +1,45 @@
+---
+slug: stacco
+title: STACCO
+description: "STACCO: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves"
+year: 2017
+target: Binary
+technique: Dynamic
+guarantees: "no"
+available: false
+papers:
+ - name: "STACCO: Differentially Analyzing Side-Channel Traces for Detecting SSL/TLS Vulnerabilities in Secure Enclaves"
+   link: https://dl.acm.org/doi/10.1145/3133956.3134016
+---
+
+## Abstract
+
+Intel Software Guard Extension (SGX) offers software applications a shielded execution environment,
+dubbed enclave, to protect their confidentiality and integrity from malicious operating systems.
+As processors with this extended feature become commercially available, many new software applications
+are developed to enrich to the SGX-enabled ecosystem. One important primitive for these applications
+is a secure communication channel between the enclave and a remote trusted party. The SSL/TLS protocol,
+which is the de facto standard for protecting transport-layer network communications, has been broadly
+regarded a natural choice for such purposes. However, in this paper, we show that the marriage between
+SGX and SSL may not be smooth sailing.
+
+Particularly, we consider a category of side-channel attacks against SSL/TLS implementations in secure
+enclaves, which we call the control-flow inference attacks. In these attacks, the malicious operating
+system kernel may perform a powerful man-in-the-kernel attack to collect execution traces of the
+enclave programs at the page level, the cacheline level, or the branch level, while positioning itself
+in the middle of the two communicating parties. At the center of our work is a differential analysis
+framework, dubbed Stacco, to dynamically analyze the SSL/TLS implementations and detect vulnerabilities
+-discernible execution traces- that can be exploited as decryption oracles. Surprisingly, in spite of
+the prevailing constant-time programming paradigm adopted by many cryptographic libraries, we found
+exploitable vulnerabilities in the latest versions of all the SSL/TLS libraries we have examined.
+
+To validate the detected vulnerabilities, we developed a man-in-the-kernel adversary to demonstrate
+Bleichenbacher attacks against the latest OpenSSL library running in the SGX enclave (with the help
+of Graphene) and completely broke the PreMasterSecret encrypted by a 4096-bit RSA public key with only
+57286 queries. We also conducted CBC padding oracle attacks against the latest GnuTLS running in
+Graphene-SGX and an open-source SGX implementation of mbedTLS (i.e., mbedTLS-SGX) that runs directly
+inside the enclave, and showed that it only needs 48388 and 25717 queries, respectively, to break one
+block of AES ciphertext. Empirical evaluation suggests these man-in-the-kernel attacks can be completed
+within 1 or 2 hours. Our results reveal the insufficient understanding of side-channel security in SGX
+settings, and our study will provoke discussions on the secure implementation and adoption of SSL/TLS
+in secure enclaves.