Write a Blog >>
ICSE 2020
Wed 24 June - Thu 16 July 2020
Sat 11 Jul 2020 00:48 - 01:00 at Baekje - P25-Fuzzing Chair(s): Marcel Böhme

Timing side channels arise in software when a program’s execution time can be correlated with security-sensitive program input. Recent results on software side-channel detection focus on analysis of program’s source code. However, runtime behavior, in particular optimizations introduced during just-in-time (JIT) compilation, can impact or even introduce timing side channels in programs. In this paper, we present a technique for automatically detecting such JIT-induced timing side channels in Java programs. We first introduce patterns to detect partitions of secret input potentially separable by side channels. Then we present an automated approach for exploring behaviors of the Java Virtual Machine (JVM) to identify states where timing channels separating these partitions arise. We evaluate our technique on three datasets used in recent work on side-channel detection. We find that many code variants labeled ``safe'' with respect to side-channel vulnerabilities are in fact vulnerable to JIT-induced timing side channels. Our results directly contradict the conclusions of four separate state-of-the-art program analysis tools for side-channel detection and demonstrate that JIT-induced side channels are prevalent and can be detected automatically.

Sat 11 Jul
Times are displayed in time zone: (UTC) Coordinated Universal Time change

00:00 - 01:00: Paper Presentations - P25-Fuzzing at Baekje
Chair(s): Marcel BöhmeMonash University
icse-2020-papers00:00 - 00:12
Haijun WangAnt Financial Services Group, China; CSSE, Shenzhen University, China, Xiaofei XieNanyang Technological University, Yi LiNanyang Technological University, Cheng WenShenzhen University, Yuekang LiNanyang Technological University, Yang LiuNanyang Technological University, Singapore, Shengchao QinUniversity of Teesside, Hongxu ChenResearch Associate, Yulei SuiUniversity of Technology Sydney, Australia
Link to publication DOI Pre-print
icse-2020-papers00:12 - 00:24
Tai D. NguyenSingapore Management University, Long H. PhamSingapore University of Technology and Design, Jun SunSingapore Management University, Yun LinNational University of Singapore, Minh Quang TranHo Chi Minh City University of Technology
icse-2020-papers00:24 - 00:36
Caius BrindescuOregon State University, Iftekhar AhmedUniversity of California at Irvine, USA, Rafael LeanoOregon State University, Anita SarmaOregon State University
icse-2020-papers00:36 - 00:48
Akond RahmanTennessee Tech University, Effat FarhanaNorth Carolina State University, Chris ParninNorth Carolina State University, Laurie WilliamsNorth Carolina State University
icse-2020-papers00:48 - 01:00
Tegan BrennanUniversity of California, Santa Barbara, Seemanta SahaUniversity of California Santa Barbara, Tevfik BultanUniversity of California, Santa Barbara