Cache template attacks demonstrated automated leakage of user input in shared libraries. However, for large binaries, the runtime is prohibitively high. Other automated approaches focused on cryptographic implementations and media software but are not directly applicable to user input. Hence, discovering and eliminating all user input side-channel leakage on a cache-line granularity within huge code bases are impractical. In this paper, we present a new generic cache template attack technique, LBTA, layered binary templating attacks. LBTA uses multiple coarser-grained side channel layers as an extension to cache-line granularity templating to speed up the runtime of cache templating attacks. We describe LBTA with a variable number of layers with concrete side channels of different granularity, ranging from 64 B to 2MB in practice and in theory beyond. In particular the software-level page cache side channel in combination with the hardware-level L3 cache side channel, already reduces the templating runtime by three orders of magnitude. We apply LBTAs to different software projects and thereby discover data deduplication and dead-stripping during compilation and linking as novel security issues. We show that these mechanisms introduce large spatial distances in binaries for data accessed during a keystroke, enabling reliable leakage of keystrokes. Using LBTA on Chromium-based applications, we can build a full unprivileged cache-based keylogger. Our findings show that all user input to Chromium-based apps is affected and we demonstrate this on a selection of popular apps including Signal, Threema, Discord, and password manager apps like passky. As this is not a flaw of individual apps but the framework, we conclude that all apps that use the framework will also be affected, i.e., hundreds of apps.

翻译：Cache 模板袭击显示共享图书馆用户输入的自动渗漏。 但是, 对于大的二进制, 运行时间太快了 。 其他以加密实施和媒体软件为重点的自动方法侧重于加密执行和媒体软件, 但不直接适用于用户输入 。 因此, 发现并消除在庞大代码基底的缓存线颗粒中所有用户输入的侧通道渗漏是不切实际的。 在本文中, 我们展示了新的通用缓存模板袭击技术、 LBTA 、 分层二进制双向缓冲攻击。 LBTA 使用多个粗略的侧端通道作为缓存颗粒颗粒质的扩展, 用于加速缓存缓存缓存袭击的运行时间, 其它自动化方法则用于加速缓存的缓存执行时间 。 在编译过程中和理论外, 特别是软件级的缓存侧端通道, 与硬件级L3缓存侧端频道一起, 已经降低了基于三个级的缓冲运行时间 。 我们在不同的软件项目中展示了LBTA,, 并由此发现数据变换不易的缓存数据, 。