Not So Secure TSC

We show that AMD's SecureTSC feature can be used for co-location detection.

Jonas Juffinger, Sudheendra Raghav Neela, Daniel Gruss

Secret Spilling Drive: Leaking User Behavior through SSD Contention

We show that a contention caused timing side-channel can leak websites visited by a victim with high accuracy.

Jonas Juffinger, Fabian Rauscher, Giuseppe La Manna, Daniel Gruss

KernelSnitch: Side-Channel Attacks on Kernel Data Structures

Lukas Maar, Jonas Juffinger, Thomas Steinbauer, Daniel Gruss, Stefan Mangard

Presshammer: Rowhammer and Rowpress without Physical Address Information

We compare Rowhammer and Rowpress on various DRAM modules and show the first end-to-end Rowpress exploit.

Jonas Juffinger, Sudheendra Raghav Neela, Martin Heckel, Lukas Schwarz, Florian Adamsky, Daniel Gruss

SUIT: Secure Undervolting with Instruction Traps

We developed a system that allows securely undervolting CPUs by trapping faulting instructions.

Jonas Juffinger, Stepan Kalinin, Daniel Gruss, Frank Mueller

SnailLoad: Remote Network Latency Measurements Leak User Activity

Exploiting bottlenecks present on all Internet connections we infer the current network activity on someone else's Internet connection

Stefan Gast, Roland Czerny, Jonas Juffinger, Fabian Rauscher, Simone Franza, Daniel Gruss

JavaSQUIP: Remote Scheduler Contention Attacks

We show the SQUIP side channel from JavaScript without a timer using a microarchitectural bingo race.

Stefan Gast, Jonas Juffinger, Lukas Maar, Christoph Royer, Andreas Kogler Daniel Gruss

IdleLeak: Exploiting Idle State Side Effects for Information Leakage

Using the tpause instruction to detect interrupts, we build a covert-channel and spy on user behavior.

Fabian Rauscher, Andreas Kogler, Jonas Juffinger, Daniel Gruss

CSI:Rowhammer - Cryptographic Security and Integrity against Rowhammer

With a MAC instead of ECC bits we are able to detect all data corruptions in DRAM and correct most.

Jonas Juffinger, Lukas Lamster, Andreas Kogler, Maria Eichlseder, Moritz Lipp, Daniel Gruss

Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channels

By colliding victim with attacker controlled data in the CPU cache we can leak arbitrary data.

Andreas Kogler, Jonas Juffinger, Lukas Giner, Lukas Gerlach, Martin Schwarzl, Michael Schwarz, Daniel Gruss, Stefan Mangard

PT-Guard: - Protected Page Tables to Defend Against Breakthrough Rowhammer Attacks

We store a MAC in unused page table bits to detect and correct corruptions caused by Rowhammer.

Anish Saxena, Gururaj Saileshwar, Jonas Juffinger, Andreas Kogler, Daniel Gruss, Moinuddin Qureshi

SQUIP: Exploiting the Scheduler Queue Contention Side Channel

By measuring contention in AMD execution unit scheduler queues we can leak RSA keys.

Stefan Gast, Jonas Juffinger, Martin Schwarzl, Gururaj Saileshwar, Andreas Kogler, Simone Franza, Markus Köstl, Daniel Gruss

Half-Double: Hammering From the Next Row Over

We show a new Rohammer method that exploits a mitigation and build a novel exploit for Chromebooks.

Andreas Kogler, Jonas Juffinger, Salman Qazi, Yoongu Kim, Moritz Lipp, Nicolas Boichat, Eric Shiu, Mattias Nissler, Daniel Gruss

Master’s Thesis: Rowhammer Exploits are still possible

Using half-double Rowhammer we develop a novel privilege escalation exploit targeting a Chromebook.

Jonas Juffinger, Advisor: Daniel Gruss

Another Flip in the Wall of Rowhammer Defenses

With a new Rowhammer method and from Intel SGX we show a completely undetectable exploit.

Daniel Gruss, Moritz Lipp, Michael Schwarz, Daniel Genkin, Jonas Juffinger, Sioli O'Connell, Wolfgang Schoechl, Yuval Yarom

Upcoming: Not So Secure TSC

Jonas Juffinger

Upcoming: KernelSnitch: Leaking Kernel Heap Pointers by Exploiting Software-Induced Side-Channel Leakage of Kernel Hash Tables

Lukas Maar, Jonas Juffinger

Upcoming: Secret Spilling Drive: Leaking User Behavior through SSD Contention

Jonas Juffinger

Looking Back at 10 Years of Rowhammer Exploits

Jonas Juffinger, Andreas Kogler

SUIT: Secure Undervolting with Instruction Traps

Daniel Gruss, Jonas Juffinger

CPU Undervolting Hackathon at PEACHES

Jonas Juffinger

Presshammer: Rowhammer and Rowpress without Physical Address Information

Jonas Juffinger

EDAMAME: Exploiting Drastically Absent Message Authentication for Meals at EPFL

Jonas Juffinger

Exploiting RowPress and RowHammer and How To Defend Against It

Jonas Juffinger

SUIT - Secure Undervolting with Instruction Traps

Jonas Juffinger, Stepan Kalinin

Rowhammer - A Never Ending Story?

Jonas Juffinger

CPU Undervolting - Exploits and Potentials / SUIT

Jonas Juffinger

CSI:Rowhammer - Cryptographic Security and Integrity against Rowhammer

Jonas Juffinger

CSI:Rowhammer - Cryptographic Security and Integrity against Rowhammer

Jonas Juffinger

CSI:Rowhammer: Closing the Case of Half-Double and Beyond

Andreas Kogler, Jonas Juffinger

Half-Double: Hammering From the Next Row Over

Jonas Juffinger

CSI:Rowhammer - Können wir Computer gleichzeitig sicherer und effizienter machen?

Daniel Gruss, Jonas Juffinger

Half-Double: Hammering From the Next Row Over

Andreas Kogler, Jonas Juffinger

Reviewer for Usenix Security Artifact Evaluation: Distinguished reviewer award

Reviewer for Transactions on Dependable and Secure Computing

Sub-reviewer for NDSS Symposium

Sub-reviewer for Usenix Security

Sub-reviewer for CCS

Sub-reviewer for DRAMSec