Write+Sync: Software Cache Write Covert Channels Exploiting Memory-Disk Synchronization

2023-12-08

IEEE Transactions on Information Forensics and Security

AI Summary

This work identifies and systematically constructs Write+Sync, a novel pure-software write-based covert channel exploiting timing discrepancies between OS memory-disk synchronization mechanisms and software write buffering—operating without hardware dependencies and evading existing defenses. It introduces the first high-speed write channel explicitly designed for software caches, proposing single- and multi-file page collaborative modulation strategies alongside multi-granularity channel encoding. A system-level implementation is realized on Linux and macOS. Experiments demonstrate an average throughput of 2.036 Kb/s (peak: 14.762 Kb/s) on Linux with 0% bit error rate (BER), and 10.211 Kb/s (peak: 253.022 Kb/s) on macOS with only 0.004% BER. The channel enables practical attacks, including website fingerprinting and performance degradation, thereby validating its real-world exploitability and threat impact.

Abstract

Memory-disk synchronization is a critical technology for ensuring data correctness, integrity, and security, especially in systems that handle sensitive information like financial transactions and medical records. We propose Write+Sync, a group of attacks that exploit the memory-disk synchronization primitives. Write+Sync works by subtly varying the timing of synchronization on a software cache (i.e., the write buffer), offering two advantages: 1) implemented purely in software, enabling deployment on any hardware devices; 2) resilient against existing countermeasures. We present the principles of Write+Sync through the implementation of two write covert channel protocols, using either a single file or page, and introduce three enhanced strategies that utilize multiple files and pages. The feasibility of these channels is demonstrated in both cross-process and cross-sandbox scenarios across diverse operating systems (OSes). Experimental results show that, the average rate can reach 2.036 Kb/s (with a peak rate of 14.762 Kb/s) and the error rate is 0% on Linux; when running on macOS, the average rate achieves 10.211 Kb/s (with a peak rate of 253.022 Kb/s) and the error rate is 0.004%. To show its security implications, we evaluate it using two case studies-website fingerprinting and performance degradation attacks. To the best of our knowledge, Write+Sync is the first high-speed write covert channel for software cache.

Problem

• SYNC+SYNC Attack
• Data Exfiltration
• Covert Channel

Innovation

• SYNC+SYNC attack
• cross-security-domain data transfer
• high-speed covert channel