BUSted!!! Microarchitectural Side-Channel Attacks on the MCU Bus Interconnect

BUSted!!! Microarchitectural Side-Channel Attacks on the MCU Bus Interconnect

Speakers: Cristiano Rodrigues; Daniel Oliveira; Sandro Pinto

Conference: IEEE S&P

YouTube: https://www.youtube.com/watch?v=L6VVXC59k9o

Overview

The talk "BUSted!!! Microarchitectural Side-Channel Attacks on the MCU Bus Interconnect," presented by Cristiano Rodrigues, Daniel Oliveira, and Sandro Pinto from the University of Minho, Portugal, unveils a groundbreaking new class of microarchitectural side-channel attacks targeting microcontrollers (MCUs). Traditionally, MCUs have been considered largely immune to such attacks due to their simpler, resource-constrained architectures, which lack complex features like caches, speculative execution, and out-of-order pipelines prevalent in high-performance CPUs. This prevailing belief has led to a false sense of security in the embedded systems domain.

This research fundamentally challenges that status quo by demonstrating that even the most basic microarchitectural elements within MCUs can be exploited to leak sensitive information. Specifically, the presentation reveals a novel side-channel vulnerability rooted in the timing variations exposed via the bus arbitration logic of the MCU's internal interconnect. The implications are significant, as billions of MCUs power a vast array of embedded and IoT devices, from smart locks to medical implants, many of which rely on their perceived isolation for security-critical operations.

The talk introduces innovative techniques, including Hardware Gadgets and Smart Gadget Networks, to overcome the unique challenges of mounting side-channel attacks on these resource-constrained, single-core devices. By successfully extracting secrets from a TrustZone-protected application on a modern ARM Cortex-M microcontroller, the research not only proves the feasibility of these attacks but also necessitates a re-evaluation of security paradigms for embedded systems.

Background

▶ Watch: Introduction to BUSTed attack and context of prior work (0:00)

The landscape of system security was dramatically altered by the discovery of microarchitectural side-channel attacks like Spectre and Meltdown. These attacks, and the subsequent wave of similar vulnerabilities, exposed the inherent dangers of performance-driven microarchitectural optimizations in high-performance CPUs from vendors like Intel, ARM, and RISC-V. These processors, designed for speed and efficiency, incorporate complex features such as multi-level caches, prefetchers, branch predictors, out-of-order execution, and speculative execution. While these features minimize the performance gap between CPU frequency and memory access, they inadvertently create numerous opportunities for attackers to observe subtle timing differences and infer secrets.

However, the focus of these high-profile attacks has predominantly been on Application Processing Units (APUs) or System-on-Chips (SoCs), which power cloud infrastructure, desktops, laptops, mobile devices, and routers. On the other end of the computing spectrum lie Microcontrollers (MCUs). These "teeny tiny" computing units are characterized by their resource constraints in terms of processing power, memory, and energy. Despite their limitations, MCUs are profoundly relevant, shipping in billions annually and forming the core of countless small-scale embedded and IoT devices.

For a long time, there was a common belief that MCUs were largely immune to microarchitectural side-channel attacks. This conviction stemmed from their fundamentally simpler microarchitectures:

• Single CPU: Typically, MCUs feature a single CPU core, often an ARM Cortex-M family processor, which simplifies execution flow.
• No Caches: Most MCUs lack complex cache hierarchies, which are a primary source of side-channel leakage in CPUs due to their persistent state.
• Minimal Pipelines: MCU pipelines are typically very shallow, often just two or three stages, in contrast to the deep pipelines of modern CPUs.
• No Virtual Memory: The absence of virtual memory further simplifies memory management.
• Deterministic Execution: Their simpler design often leads to highly deterministic execution times, seemingly eliminating timing variability.

These characteristics led many to believe that the "ground for side channels" found in complex CPUs simply did not exist in MCUs. The research presented in this talk directly challenges this assumption, seeking to identify unique microarchitectural elements within MCUs that could still give rise to novel side-channels and pave the way for new attacks.

Key Findings

▶ Watch: Identifying the MCU bus interconnect as a novel side channel (3:30)

The central discovery of this research is the identification of the MCU bus interconnect—specifically, the timing exposures arising from its arbitration logic—as a novel and pervasive source of side-channel leakage. This finding shatters the long-held belief that MCUs are immune to microarchitectural side-channel attacks.

The key findings can be summarized as follows:

1. Pervasive Bus Interconnect Side-Channel: The researchers demonstrated that when multiple masters (e.g., the CPU and a DMA controller) attempt to access a shared memory bank simultaneously, contention arises on the bus interconnect. This contention introduces measurable timing differences, as only one master can proceed at a time, delaying the other. This timing difference, though subtle, creates a reliable side-channel. The pervasiveness of this channel was validated across 11 different ARM Cortex-M family boards (with 4 presented in the talk), establishing a clear, noiseless, and deterministic 8-bit cover channel on every tested platform.

1. Software-Based Microarchitectural Attacks on MCUs: The paper provides concrete evidence for a new class of software-based microarchitectural side-channel attacks tailored for MCUs. Unlike CPU attacks that often rely on cache states or speculative execution, these attacks leverage the fundamental load/store instruction behavior in conjunction with bus contention. By observing when a load or store instruction causes contention on the data memory bus, an attacker can infer the execution path of a victim program, even if the program is designed to be constant-time.

1. Introduction of Hardware Gadgets: To overcome the unique challenges of attacking MCUs (such as the lack of persistent microarchitectural state like caches, single-core architecture preventing concurrent spy/victim execution, and the need for single-run secret extraction), the researchers introduced the concept of Hardware Gadgets. These gadgets are groups of peripherals, able to run independently of the CPU, that are configured to monitor bus contention and record a memory trace. This innovative approach allows the spy to gather crucial timing information in the background, without CPU intervention, effectively "seeing" the transient state of the bus interconnect.

1. Smart Gadget Network: Building upon the concept of individual Hardware Gadgets, the research proposes a Smart Gadget Network. This network integrates multiple specialized Hardware Gadgets (e.g., a trigger gadget, a detection gadget, a counter gadget, an auto-sync gadget, and a read secret gadget) to orchestrate sophisticated attacks. This coordinated action enables the attacker to precisely monitor, synchronize with, and extract secrets from victim applications in a single run, even within secure execution environments.

1. Bypassing TrustZone Isolation: As a crowning achievement, the paper presents a reference attack, dubbed "BUSted!," that successfully bypasses ARM TrustZone isolation on a modern ARM Cortex-M microcontroller. The attack was able to steal a secret PIN from a smart lock application running within the secure world (TrustZone environment) while the attacker's spy code operated from the non-secure world. This demonstrates a practical and severe compromise of state-of-the-art MCU security mechanisms.

These findings collectively redefine the security landscape for microcontrollers, highlighting the need for new architectural considerations and defensive strategies in embedded systems design.

Technical Deep Dive

▶ Watch: Validating the channel with an 8-bit noiseless cover channel (4:45)

The core of the "BUSted!" attack lies in exploiting the bus interconnect arbitration logic within microcontrollers. Unlike complex CPUs, MCUs typically have a simple interconnect where multiple masters (e.g., the CPU, DMA controller, or other peripherals) share access to memory banks. When the CPU issues a transaction to access a specific memory location, and no other master is attempting to access memory simultaneously, the transaction proceeds normally. Similarly, if a DMA (Direct Memory Access) controller attempts an access without contention, it also proceeds unimpeded.

However, the critical scenario arises when both the CPU and another master (such as a DMA controller configured by the attacker) issue a memory transaction at the exact same time. This creates contention on the bus. The bus arbitration logic then determines which master gains access, delaying the other. This delay, though minimal, creates a measurable timing difference that can be observed and exploited as a side-channel.

The researchers leveraged the MCU's load and store architecture, where only load and store instructions can access data memory, while other instructions primarily access code memory. This distinction is crucial because it allows an attacker to infer when a load or store instruction executes by monitoring contention on the data memory bus connected to the CPU.

Consider a basic conditional code snippet, such as an if-else statement that processes a secret:

Most instructions in such a snippet might take one clock cycle to execute and be constant across both execution paths. The key difference often lies in branch instructions. For instance, a branch equal instruction might take 3 clock cycles if the branch is taken, but only 1 clock cycle if it falls through. This seemingly minor difference in branch instruction timing directly impacts the relative position of subsequent instructions, such as the store_instruction.

As illustrated in the talk's example:

• If the IF branch is executed (secret is 1), the branch equal instruction might take 1 clock cycle (not taken). This causes the store_instruction to create contention on clock cycle t+3.
• If the ELSE branch is executed (secret is 0), the branch equal instruction might take 3 clock cycles (taken). This shifts the timing, causing the store_instruction to create contention on clock cycle t+5.

Crucially, this code might be considered constant-time in a traditional sense, as both paths might complete in the same total number of clock cycles (e.g., 7 cycles). However, due to the branch instruction's variable timing, the relative position of the store_instruction changes. An attacker monitoring for contention at a specific clock cycle (e.g., t+3 or t+5) can infer which path was executed and, consequently, the value of the secret.

Mounting such an attack on MCUs presents several unique challenges compared to CPU-based side-channels:

1. No Persistent State: MCUs typically lack caches, which are common sources of persistent state leakage (e.g., cache hit/miss). The bus interconnect is a transient state channel; once contention resolves, there's no lasting observable state difference. This means a spy cannot assess past microarchitectural states.
2. Single-Core Architecture: Most MCUs are single-core, preventing concurrent execution of a spy and a victim. The spy cannot run alongside the victim to observe its effects in real-time.
3. Single-Run Secret Stealing: Many MCU secrets are ephemeral, requiring the secret to be stolen in a single execution run.
4. Mitigations Against Prior Attacks: The researchers assumed existing mitigations against previous side-channel attacks (e.g., against NOPs or simple timing differences) and an inability to interrupt the victim.

To address these challenges, the researchers introduced Hardware Gadgets. These leverage the vast array of peripherals common in MCUs, which are capable of running independently from the CPU. A Hardware Gadget is essentially a group of configured peripherals that collectively monitor bus contention and capture a memory trace without CPU involvement.

The conceptual flow is:

1. The CPU executes the spy's setup code.
2. The victim executes, creating contention on the bus.
3. Simultaneously, the pre-configured Hardware Gadget (running independently) captures a trace of this contention.
4. The CPU (spy) later retrieves the trace from the Hardware Gadget, inferring the secret.

This innovative approach effectively solves the challenges: the Hardware Gadget captures transient state, runs in the background without concurrent CPU execution, and enables single-run secret extraction.

For more complex attacks, the concept of a Smart Gadget Network was developed. This network comprises multiple specialized Hardware Gadgets working in concert:

• Trigger Gadget: Initiates monitoring based on a specific event or timing.
• Detection Gadget: Checks for contention at precise clock cycles (e.g., "Clock Cycle 14" as seen in the demo).
• Counter Gadget: Tracks loop indices or other execution context, directly linking observed contention to a specific part of the secret.
• Auto-Sync Gadget: Ensures precise synchronization with the victim's execution at a clock-cycle level.
• Read Secret Gadget: Captures or signals the inferred secret.

By orchestrating these gadgets, the attacker can build a sophisticated, autonomous monitoring system that functions in the background, making it extremely difficult to detect and mitigate using traditional software-based security measures.

Demo / Proof of Concept

▶ Watch: Demonstrating secret leakage from branch instruction timing (5:20)

The "BUSted!" attack was demonstrated as a proof-of-concept (PoC) against a Smart Lock application running on a single-core ARM Cortex-M microcontroller. The target system utilized ARM TrustZone, a hardware-enforced isolation mechanism that divides the MCU into a Secure World (running critical firmware, like the victim application, and handling sensitive data) and a Non-Secure World (where less trusted applications, like the attacker's spy, typically reside). The spy's objective was to steal a PIN entered by the user into the Smart Lock, a secret processed within the Secure World. Both the spy and the victim shared a common memory bank.

The victim application's code snippet targeted by the attack involved five main structures:

1. Read keypad: Reads the state of the physical keypad.
2. Read key: Processes individual key presses.
3. A loop that iterates over all possible keys on the keypad (in the demo, a 60-key keyboard).
4. An if branch executed if a key is pressed.
5. An else branch executed if no key is pressed.

The critical leakage occurs within this loop. When a user presses a specific key, the if path for that key's processing is executed. If no key is pressed, the else path is executed. The timing difference between the if and else paths, specifically related to a store instruction, is what the attacker monitors.

The "BUSted!" attack operates in two distinct phases:

1. Profiling Phase (Offline):

• This phase is conducted in a controlled lab setting where the attacker has full control over the target MCU.
• The attacker uses a set of Hardware Gadgets to profile the execution of both the if and else paths of the target code snippet.
• By running the victim code multiple times, forcing either the if or else path, the attacker collects detailed timing traces of bus contention.
• For example, the traces reveal that if the if path is executed, contention might be observed at a specific Clock Cycle 14. If the else path is executed, no contention is observed at Clock Cycle 14. This crucial difference forms the basis for detection.

1. Exploitation Phase (Online):

• In this phase, the attacker deploys their spy code, including the configured Hardware Gadgets, into the Non-Secure World of the Smart Lock device.
• The Smart Gadget Network is programmed based on the contention points identified during the profiling phase. The network consists of several integrated Hardware Gadgets:
• A Trigger Gadget to initiate the monitoring.
• A Detection Gadget specifically configured to check for bus contention at Clock Cycle 14.
• A Counter Gadget to keep track of the current loop index (i.e., which key is currently being processed in the 60-key loop). This gadget is directly connected to the secret (the key pressed).
• An Auto-Sync Gadget to maintain precise clock-cycle level synchronization with the victim's execution.
• A Read Secret Gadget to capture the secret once contention is detected.
• When the user enters their PIN on the Smart Lock's keypad, the victim application in the Secure World processes each key press within its loop.
• As the victim code iterates through the 60 possible keys, the Smart Gadget Network continuously monitors the bus.
• When the loop index matches the actual key pressed by the user, the if path is executed. This execution causes contention at Clock Cycle 14.
• The Detection Gadget immediately identifies this contention.
• Concurrently, the Counter Gadget has been tracking the loop index. Upon detection, the network knows that the secret (the pressed key) corresponds to the current value of the loop index.
• The Read Secret Gadget then records this value, successfully stealing the PIN from the Secure World without any CPU intervention from the spy.

This demonstration compellingly showcases that secrets can be extracted from TrustZone-protected applications on modern MCUs, proving the efficacy of the "BUSted!" attack and the innovative Hardware Gadget methodology.

Defensive Implications

▶ Watch: Overcoming challenges of transient state and single-core MCUs (8:00)

The "BUSted!" attack exposes a fundamental vulnerability in microcontroller architectures that relies on shared resources and their arbitration mechanisms. Addressing these issues requires a multi-faceted approach, moving beyond traditional software-only mitigations.

1. Hardware-Level Modifications to Bus Arbitration: The most direct mitigation would involve redesigning the MCU's bus interconnect and arbitration logic to be constant-time, regardless of contention. This could involve:

• Fixed Latency Accesses: Implementing memory access mechanisms that always take a fixed number of clock cycles, even if contention occurs. This might involve padding or stalling mechanisms that introduce artificial delays to mask real contention.
• Contention Obfuscation: Introducing noise or randomization into the arbitration process to make timing differences unpredictable and non-deterministic from an attacker's perspective.
• Dedicated Bus Segments: For highly sensitive operations, dedicated bus segments or memory banks could be provisioned to prevent contention with untrusted masters. However, this could significantly increase hardware complexity and cost for resource-constrained MCUs.

1. Software Countermeasures (Limited Scope): While the attack is microarchitectural, certain software practices can reduce exposure:

• Strict Constant-Time Programming: Developers must rigorously adhere to constant-time programming principles, not just for cryptographic operations but for all code that handles secrets. This includes ensuring that not only the total execution time but also the relative timing of memory accesses (loads/stores) remains invariant across all execution paths, regardless of secret values. This is far more challenging than previously thought, given the bus contention issue.
• Avoid Data-Dependent Control Flow: Minimizing branches and loops whose execution path or iteration count depends on secret data can reduce the attack surface.
• Code Padding/Randomization: Introducing dummy memory accesses or NOPs to equalize execution times and memory access patterns. However, this can be complex to implement effectively against fine-grained microarchitectural channels and might introduce performance overhead.

1. Enhanced Monitoring and Detection:

• Hardware-Assisted Anomaly Detection: Incorporating on-chip hardware monitors that can detect unusual bus contention patterns or excessive peripheral activity, especially from the non-secure world, could potentially flag ongoing attacks.
• Performance Monitoring Unit (PMU) Enhancements: If available, PMUs could be enhanced to provide more granular, secure access to bus activity metrics, allowing the secure world to detect anomalous behavior.

1. Rethinking TrustZone and Secure Enclaves: The attack's success in bypassing TrustZone highlights that hardware isolation mechanisms, while robust against logical software bugs, may not inherently protect against microarchitectural leakage. Future secure enclave designs must explicitly consider and mitigate side-channel vulnerabilities stemming from shared hardware resources. This might involve:

• Resource Partitioning: More aggressive partitioning of shared resources (e.g., DMA controllers, specific memory regions) between secure and non-secure worlds, even at the cost of flexibility.
• Side-Channel Aware Compilers/Toolchains: Developing compilers and toolchains that can automatically analyze and mitigate side-channel leakage during code generation, similar to efforts for cache-based attacks.

The "BUSted!" research underscores that security in embedded systems requires a holistic approach, where hardware architects, software developers, and system designers must collaborate to identify and mitigate microarchitectural vulnerabilities from the ground up. The sheer volume of MCUs in critical applications means that these defensive implications are not merely theoretical but demand urgent attention to prevent widespread exploitation.

Key Takeaways

• MCUs are Vulnerable to Microarchitectural Side-Channels: The long-held belief that microcontrollers are immune to microarchitectural side-channel attacks due to their simpler design is fundamentally challenged and proven false.
• Bus Interconnect Arbitration is a Novel Side-Channel: The timing variations caused by contention on the MCU's bus interconnect arbitration logic represent a new, pervasive, and deterministic source of side-channel leakage.
• Hardware Gadgets Enable MCU Side-Channel Attacks: The innovative concept of Hardware Gadgets, leveraging independent peripherals to monitor bus activity without CPU intervention, overcomes the unique challenges of attacking resource-constrained, single-core MCUs with transient state channels.
• Smart Gadget Networks Orchestrate Sophisticated Attacks: By combining multiple specialized Hardware Gadgets into a Smart Gadget Network, attackers can perform complex, single-run secret extraction attacks, even against secure execution environments.
• TrustZone Isolation Can Be Bypassed: The "BUSted!" attack successfully demonstrated the ability to steal a secret PIN from a TrustZone-protected smart lock application on a modern ARM Cortex-M microcontroller, highlighting the need for re-evaluating hardware isolation mechanisms.
• New Defensive Strategies Are Required: Mitigating these attacks necessitates a shift towards hardware-level changes in bus arbitration, rigorous constant-time programming, and a re-evaluation of security paradigms for embedded systems, moving beyond purely software-based protections.

About the Speaker(s)

The research was presented by Cristiano Rodrigues, a PhD student at the University of Minho in Portugal. He conducted this work in collaboration with Daniel Oliveira and Sandro Pinto, also from the University of Minho. Their collective expertise in embedded systems security and microarchitectural analysis led to the discovery and demonstration of these novel side-channel attacks on microcontrollers.