Rootsec Research Group
Microarchitectural Side-channel Attacks and System Security
Our research group at the CISPA Helmholtz Center for Information Security is working on the low-level security of modern computer systems, focusing on microarchitectural and side-channel attacks and defenses. The research includes the security of CPUs, operating systems, and trusted execution environments.
Our Topics
We investigate fundamental security challenges at the hardware and system level. Our work focuses on discovering and mitigating vulnerabilities in processors, memory systems, and low-level system software.
Side-Channel Attacks
# Extracting Secrets Through Observable Behavior
Every operation your computer performs leaves subtle traces - tiny variations in timing, power consumption, or electromagnetic emissions. Side-channel attacks exploit these observable side effects to extract sensitive information like encryption keys, passwords, and private data without directly breaking cryptographic algorithms.
What we do: We discover novel side-channel vulnerabilities through cache timing analysis, power analysis, and other measurement techniques, then develop defenses to prevent information leakage.
Research contributions:
- Cache-based side channels: Analysis of CPU cache behavior for extracting cryptographic keys and breaching isolation boundaries
- Cross-domain leakage: Research on side channels that cross security boundaries between processes, VMs, and trusted execution environments
Microarchitectural Security
# Exploiting CPU Design Vulnerabilities
Modern processors are incredibly complex, using techniques like speculative execution, branch prediction, and out-of-order execution to maximize performance. However, these optimizations create security vulnerabilities at the microarchitectural level that can be exploited to bypass fundamental security boundaries and access privileged information.
What we do: We analyze CPU microarchitecture to discover design-level vulnerabilities in speculative execution, memory ordering, and privilege isolation, then collaborate with manufacturers to develop hardware and software mitigations.
Research contributions:
- GhostWrite: A vulnerability in RISC-V processors affecting speculative execution security
- CacheWarp: Cache-based attacks on AMD SEV enabling privilege escalation
- Transient execution attacks: Research on speculative execution vulnerabilities across x86, ARM, and RISC-V architectures
- Microarchitectural isolation: Analysis of vulnerabilities affecting sandboxes, virtual machines, and trusted execution environments
DRAM Security
# Memory Reliability and Security
Computer memory consists of a grid of electrical cells. Rowhammer attacks exploit a reliability issue in DRAM where repeatedly accessing specific memory rows can induce bit flips in adjacent rows. These bit flips can be leveraged to compromise system security.
What we do: We study Rowhammer attacks and develop defenses and simulation tools to protect memory integrity.
Research contributions:
- Hammulator: An open-source simulation framework for prototyping and testing Rowhammer exploits and defenses
- Rowhammer mitigation bypasses: Research on circumventing Rowhammer mitigations such as TRR (Target Row Refresh)
- Cache slice function reverse engineering: Methods for determining physical address mappings in modern processors
System Security
# Tools, Defenses, and System-Level Security Analysis
We develop security tools, compiler-based defenses, and mitigation techniques for system-level vulnerabilities. Our research spans from low-level system software to browser security.
What we do: We develop security tools, analyze system-level attack surfaces, and create mitigation techniques for emerging threats.
Research contributions:
- IRQGuard: Defenses against interrupt-based timing attacks
- Compiler-based security: Automated code hardening and vulnerability prevention techniques
- HyperDbg: Debugging framework for low-level security analysis
- Switchpoline: Mitigations for speculative execution attacks
- Peripheral Instinct: Security analysis of WebHID and WebUSB APIs
- CSS-based tracking: Research on fingerprinting techniques using Cascading Style Sheets
- Browser timing attacks: Analysis of microarchitectural side channels in browser environments
News
We are at S&P!
We are at WWW!
We won the Distinguished Artifact Award at NDSS!
Our Research
Recent Publications
Latest from Our Blog
# The StackWarp Vulnerability
StackWarp is a security vulnerability that exploits a synchronization bug present in all AMD Zen 1–5 processors. In the context of SEV-SNP, this flaw allows malicious VM hosts to manipulate the guest VM’s stack pointer. This enables hijacking of both control and data flow, allowing an attacker to achieve remote code execution and privilege escalation inside a confidential VM.
Interested in working with us?
We are always looking for talented and motivated students to join our team. If you are interested in working with us, please check out our open positions or reach out to us directly. We look forward to hearing from you!
