🤖 AI Summary
Traditional cache-based side-channel attacks suffer from coarse granularity and limited applicability due to their reliance on cache access patterns or stall cycles. To address this, we propose MCHammer—a novel microarchitectural timing attack leveraging Machine Clear events. For the first time, our approach repurposes the CPU’s self-modifying code (SMC) detection mechanism—which triggers a Machine Clear—as a fine-grained, zero-memory-access, zero-stall-cycle side channel, thereby overcoming inherent limitations of cache-based techniques such as Flush+Reload. Through microarchitectural reverse engineering, precise event timing, controlled SMC triggering, and side-channel signal modeling, MCHammer enables high-precision secret key recovery. We experimentally validate the attack on real-world cryptographic software across multiple platforms, demonstrating both cross-platform practicality and tangible real-world threat impact.
📝 Abstract
Microarchitectural timing attacks exploit subtle timing variations caused by hardware behaviors to leak sensitive information. In this paper, we introduce MCHammer, a novel side-channel technique that leverages machine clears induced by self-modifying code detection mechanisms. Unlike most traditional techniques, MCHammer does not require memory access or waiting periods, making it highly efficient. We compare MCHammer to the classical Flush+Reload technique, improving in terms of trace granularity, providing a powerful side-channel attack vector. Using MCHammer, we successfully recover keys from a deployed implementation of a cryptographic tool. Our findings highlight the practical implications of MCHammer and its potential impact on real-world systems.