Scientists have built a variety of covert channels for secretive information transmission with CPU cache and main memory. In this paper, we turn to a lower level in the memory hierarchy, i.e., persistent storage. Most programs store intermediate or eventual results in the form of files and some of them call fsync to synchronously persist a file with storage device for orderly persistence. Our quantitative study shows that one program would undergo significantly longer response time for fsync call if the other program is concurrently calling fsync, although they do not share any data. We further find that, concurrent fsync calls contend at multiple levels of storage stack due to sharing software structures (e.g., Ext4's journal) and hardware resources (e.g., disk's I/O dispatch queue). We accordingly build a covert channel named Sync+Sync. Sync+Sync delivers a transmission bandwidth of 20,000 bits per second at an error rate of about 0.40% with an ordinary solid-state drive. Sync+Sync can be conducted in cross-disk partition, cross-file system, cross-container, cross-virtual machine, and even cross-disk drive fashions, without sharing data between programs. Next, we launch side-channel attacks with Sync+Sync and manage to precisely detect operations of a victim database (e.g., insert/update and B-Tree node split). We also leverage Sync+Sync to distinguish applications and websites with high accuracy by detecting and analyzing their fsync frequencies and flushed data volumes. These attacks are useful to support further fine-grained information leakage.

翻译：科学家们已利用CPU缓存和主存构建了多种隐蔽信道用于隐秘信息传输。本文转向内存层次结构中更底层的持久化存储。大多数程序将中间或最终结果以文件形式保存，部分程序调用fsync以同步方式将文件持久化到存储设备，确保有序存储。我们的定量研究表明，当两个程序同时调用fsync时（即使二者不共享任何数据），其中一方调用fsync的响应时间会显著延长。进一步发现，因共享软件结构（如Ext4的日志系统）和硬件资源（如磁盘I/O调度队列），并发fsync调用会在存储栈的多个层级产生竞争。据此我们构建了名为Sync+Sync的隐蔽信道。在普通固态硬盘上，Sync+Sync可实现每秒20000比特的传输带宽，错误率约0.40%。该信道支持跨磁盘分区、跨文件系统、跨容器、跨虚拟机甚至跨磁盘驱动器运行，且无需被传输数据的程序间共享数据。随后，我们利用Sync+Sync发起侧信道攻击，成功精准检测目标数据库操作（如插入/更新及B树节点分裂）。通过检测与分析目标程序的fsync调用频率和数据刷新量，我们还可高精度区分不同应用程序与网站。此类攻击有助于支撑更细粒度的信息泄露。