I Know What You Sync: Covert and Side Channel Attacks on File Systems via syncfs
Cheng Gu, Yicheng Zhang, Nael Abu-Ghazaleh

TL;DR
This paper reveals new file system side channels that break logical isolation, demonstrating covert and side channel attacks on Linux and Windows, with high accuracy and bandwidth, exploiting timing leaks during syncfs operations.
Contribution
It uncovers timing-based side channels in file systems that enable covert and side channel attacks across containers and applications, a novel security threat.
Findings
Achieved covert channel bandwidth of up to 7.6 Kbps with low error rates.
Developed website, video, and application fingerprinting attacks with over 90% accuracy.
Demonstrated cross-container covert channels and detection techniques.
Abstract
Operating Systems enforce logical isolation using abstractions such as processes, containers, and isolation technologies to protect a system from malicious or buggy code. In this paper, we show new types of side channels through the file system that break this logical isolation. The file system plays a critical role in the operating system, managing all I/O activities between the application layer and the physical storage device. We observe that the file system implementation is shared, leading to timing leakage when using common I/O system calls. Specifically, we found that modern operating systems take advantage of any flush operation (which saves cached blocks in memory to the SSD or disk) to flush all of the I/O buffers, even those used by other isolation domains. Thus, by measuring the delay of syncfs, the attacker can infer the I/O behavior of victim programs. We then demonstrate…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Digital and Cyber Forensics · Internet Traffic Analysis and Secure E-voting
