KeyDrown: Eliminating Keystroke Timing Side-Channel Attacks
This addresses a security vulnerability for users by preventing sensitive input leakage through side-channel attacks, representing a novel approach to closing gaps in existing countermeasures.
The paper tackles the problem of keystroke timing side-channel attacks by introducing KeyDrown, a defense mechanism that injects fake keystrokes in the kernel and propagates them through the software stack to hide cache activity, resulting in the elimination of any attacker advantage from interrupt or cache side-channel information on commodity notebooks and Android smartphones.
Besides cryptographic secrets, side-channel attacks also leak sensitive user input. The most accurate attacks exploit cache timings or interrupt information to monitor keystroke timings and subsequently infer typed words and sentences. Previously proposed countermeasures fail to prevent keystroke timing attacks as they do not protect keystroke processing among the entire software stack. We close this gap with KeyDrown, a new defense mechanism against keystroke timing attacks. KeyDrown injects a large number of fake keystrokes in the kernel to prevent interrupt-based attacks and Prime+Probe attacks on the kernel. All keystrokes, including fake keystrokes, are carefully propagated through the shared library in order to hide any cache activity and thus to prevent Flush+Reload attacks. Finally, we provide additional protection against Prime+Probe for password input in user space programs. We show that attackers cannot distinguish fake keystrokes from real keystrokes anymore and we evaluate KeyDrown on a commodity notebook as well as on two Android smartphones. We show that KeyDrown eliminates any advantage an attacker can gain from using interrupt or cache side-channel information.