When: Jan 31, 2025, 09:30 – 12:15
Where: VU Campus, NU building, room NU-5A47
Prelude: Jan 30, 2025, 11:30 – 12:15, room NU-4B43
Directions to NU building: https://vusec.net/directions
This mini workshop features a strong line-up of leading systems security researchers from around the world. The event is freely accessible to everyone on a first come, first serve basis.
Note: The workshop is on Jan 31 in the morning, but we’ll feature a short prelude from Google security researchers on Jan 30.
Speakers
Alexandra Sandulescu, Matteo Rizzo
(Google Security Team)
Shweta Shinde (ETH Zurich)
Oleksii Oleksenko (MSR)
Thorsten Holz (CISPA)
Prelude (Jan 30 at VU, NU-4B43)
| 11:30 | Speakers: Alexandra Sandulescu, Matteo Rizzo (Google Security Team) Title: Going beyond /etc/shadow Abstract: At Google, we were curious if we could “get root” by exploiting a CPU vulnerability. We successfully exploited multiple vulnerabilities and developed novel techniques to facilitate exploitation. In this presentation, we share some parts of our learning journey with the community and announce our upcoming program that will make it possible for others to join our quest. Bio: We are part of the Google Security Team. Our group focuses on practical exploitation of CPU vulnerabilities, mitigation, validation, and vulnerability research. |
| 12:15 | Closing remarks |
Workshop program (Jan 31 at VU, NU-5A47)
| 09:30 | Coffee and tea |
| 09:55 | Opening by Cristiano Giuffrida (AMSec) |
| 10:00 | Speaker: Shweta Shinde Title: Ahoi Attacks: Breaking Confidential VMs with Malicious Interrupts Abstract: Hardware-based Trusted execution environments (TEEs) offer an isolation granularity of virtual machine abstraction. They provide confidential VMs (CVMs) that host security-sensitive code and data. AMD SEV-SNP and Intel TDX both enable CVMs and are now available on major cloud platforms. The untrusted hypervisor in these settings is in control of several resource management and configuration tasks, including interrupts. I will present Heckler and WeSee two new attacks wherein the hypervisor injects malicious interrupts to break the confidentiality and integrity of CVMs. Our insight is to invoke the interrupt handlers that have global effects, such that we can manipulate a CVM’s register states to change the data and control flow. We demonstrate our attacks with different case studies and show their rich primitives on user- and kernel-space code to gain root privileges on the victim CVMs. The talk will conclude on extension of these attacks to prior and future generation of TEEs such as Intel SGX and Arm CCA. Bio: Shweta Shinde is a tenure-track assistant professor at ETH Zurich, where she leads the Secure and Trustworthy Systems Group. Her research is broadly at the intersection of trusted computing, system security, and program analysis. Her group focuses on foundational aspects of confidential computing to protect phones, servers, and accelerators as well as practical aspects of building large systems. |
| 10:45 | Speaker: Oleksii Oleksenko Title: Revizor as a Platform for Side Channel Testing Abstract: Attacks such as Spectre and Meltdown use a combination of speculative execution and shared microarchitectural state to leak information across security domains. Defeating them without massive performance overheads requires careful co-design of software and hardware. This talk will present a principled approach for such co-design, based on hardware-software contracts for secure speculation, as well as a platform to test hardware and software using these contract. Bio: Oleksii is a senior researcher at Azure Research, Microsoft in Cambridge, UK. His main focus is on microarchitectural/side-channel vulnerabilities, such as Spectre and Meltdown. He develops specs to describe them, builds tools that detect them, and develops mitigations against these vulnerabilities, across multiple layers of the computing stack. |
| 11:30 | Speaker: Thorsten Holz Title: Efficient and Scalable Fuzzing of Complex Software Systems Abstract: In recent years, randomized testing, commonly known as “fuzzing”, has gained significant traction as an effective method for identifying bugs in a wide variety of systems. In this talk, I will present an overview of our recent progress in fuzzing and some of the methods we have developed over the past few years. Our work includes fuzzing web browsers, operating system kernels, hypervisors, and embedded systems. I will also introduce a new perspective on generating input for highly complex formats without relying on heavyweight program analysis techniques, coarse-grained grammar approximations, or human domain experts. Finally, I will conclude the talk with an outlook on open challenges and future research directions in the evolving landscape of software security and testing. Bio: Thorsten Holz is a faculty member at the CISPA Helmholtz Center for Information Security. Before joining CISPA in October 2021, he was a full professor at the Faculty of Electrical Engineering and Information Technology at Ruhr University Bochum, Germany. His research interests include technical aspects of secure systems, with a specific focus on systems security. |
| 12:15 | Closing remarks |
