Challenges in Detecting an “Evasive Spectre”

Spectre attacks exploit serious vulnerabilities in modern CPU design to extract sensitive data through side channels. Completely fixing the problem would require a redesign of the architecture for conditional execution which cannot be backported. Researchers have proposed to detect Spectre with promising accuracy by monitoring deviations in microarchitectural events using existing hardware performance counters. However, the attacker may attempt to evade detection by reshaping the microarchitectural profile of Spectre so as to mimic benign programs. This letter thus identifies the challenges in detecting “Evasive Spectre” attacks by showing that the detection accuracy drops significantly after the attacker inserted carefully chosen instructions in the middle of an attack or periodically put the attack to sleep at a frequency higher than the victim's sampling rate when operating the attack at a lower bandwidth, yet with reasonable success rate.