36 citations · 130 across the 17 of their papers we have counts for
17 papers
SoK: Rowhammer on Commodity Operating Systems
Zhi Zhang, Decheng Chen, Jiahao Qi +8
Rowhammer has drawn much attention from both academia and industry in the past years as rowhammer exploitation poses severe consequences to system security. Since the first compreh…
SpecBox: A Label-Based Transparent Speculation Scheme Against Transient Execution Attacks
Bowen Tang, Chenggang Wu, Zhe Wang +6
Speculative execution techniques have been a cornerstone of modern processors to improve instruction-level parallelism. However, recent studies showed that this kind of techniques…
Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search
Yiru Zhao, Xiaoke Wang, Lei Zhao +2
Coverage-based greybox fuzzing (CGF) has been approved to be effective in finding security vulnerabilities. Seed scheduling, the process of selecting an input as the seed from the…
PThammer: Cross-User-Kernel-Boundary Rowhammer through Implicit Accesses
Zhi Zhang, Yueqiang Cheng, Dongxi Liu +3
Rowhammer is a hardware vulnerability in DRAM memory, where repeated access to memory can induce bit flips in neighboring memory locations. Being a hardware vulnerability, rowhamme…
Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
Yuankun Zhu, Yueqiang Cheng, Husheng Zhou +1
Deep Neural Networks (DNNs) models become one of the most valuable enterprise assets due to their critical roles in all aspects of applications. With the trend of privatization dep…
Continuous Release of Data Streams under both Centralized and Local Differential Privacy
Tianhao Wang, Joann Qiongna Chen, Zhikun Zhang +5
In this paper, we study the problem of publishing a stream of real-valued data satisfying differential privacy (DP). One major challenge is that the maximal possible value can be q…
DRAMDig: A Knowledge-assisted Tool to Uncover DRAM Address Mapping
Minghua Wang, Zhi Zhang, Yueqiang Cheng +1
As recently emerged rowhammer exploits require undocumented DRAM address mapping, we propose a generic knowledge-assisted tool, DRAMDig, which takes domain knowledge into considera…
GhostKnight: Breaching Data Integrity via Speculative Execution
Zhi Zhang, Yueqiang Cheng, Surya Nepal
Existing speculative execution attacks are limited to breaching confidentiality of data beyond privilege boundary, the so-called spectre-type attacks. All of them utilize the chang…
TeleHammer: A Formal Model of Implicit Rowhammer
Zhi Zhang, Yueqiang Cheng, Dongxi Liu +2
The rowhammer bug allows an attacker to gain privilege escalation or steal private data. A key requirement of all existing rowhammer attacks is that an attacker must have access to…
PCKV: Locally Differentially Private Correlated Key-Value Data Collection with Optimized Utility
Xiaolan Gu, Ming Li, Yueqiang Cheng +2
Data collection under local differential privacy (LDP) has been mostly studied for homogeneous data. Real-world applications often involve a mixture of different data types such as…
SpecuSym: Speculative Symbolic Execution for Cache Timing Leak Detection
Shengjian Guo, Yueqi Chen, Peng Li +4
CPU cache is a limited but crucial storage component in modern processors, whereas the cache timing side-channel may inadvertently leak information through the physically measurabl…
PiBooster: A Light-Weight Approach to Performance Improvements in Page Table Management for Paravirtual Virtual-Machines
Zhi Zhang, Yueqiang Cheng
In paravirtualization, the page table management components of the guest operating systems are properly patched for the security guarantees of the hypervisor. However, none of them…
SvTPM: A Secure and Efficient vTPM in the Cloud
Juan Wang, Chengyang Fan, Jie Wang +5
Virtual Trusted Platform Modules (vTPMs) have been widely used in commercial cloud platforms (e.g. Google Cloud, VMware Cloud, and Microsoft Azure) to provide virtual root-of-trust…
Understanding Rowhammer Attacks through the Lens of a Unified Reference Framework
Xiaoxuan Lou, Fan Zhang, Zheng Leong Chua +3
Rowhammer is a hardware-based bug that allows the attacker to modify the data in the memory without accessing it, just repeatedly and frequently accessing (or hammering) physically…
Interface-Based Side Channel Attack Against Intel SGX
Jinwen Wang, Yueqiang Cheng, Qi Li +1
Intel has introduced a trusted computing technology, Intel Software Guard Extension (SGX), which provides an isolated and secure execution environment called enclave for a user pro…
KASR: A Reliable and Practical Approach to Attack Surface Reduction of Commodity OS Kernels
Zhi Zhang, Yueqiang Cheng, Surya Nepal +3
Commodity OS kernels have broad attack surfaces due to the large code base and the numerous features such as device drivers. For a real-world use case (e.g., an Apache Server), man…
CATTmew: Defeating Software-only Physical Kernel Isolation
Yueqiang Cheng, Zhi Zhang, Surya Nepal +1
All the state-of-the-art rowhammer attacks can break the MMU-enforced inter-domain isolation because the physical memory owned by each domain is adjacent to each other. To mitigate…