Dynamic Frequency-Based Fingerprinting Attacks against Modern Sandbox Environments

Container and sandbox technologies promise isolation between co-located workloads. This paper shows that the CPU frequency reporting sensors on Intel and AMD processors, which user-space attackers can read, break that promise. Docker images exhibit a unique frequency signature, allowing containers to be distinguished with up to 84.5% accuracy even when several run simultaneously on different cores. The attack also succeeds against Google’s gVisor, AWS Firecracker, Gramine running on Intel SGX, and AMD SEV, reaching over 70% accuracy in under 40 seconds in every case. We propose a noise-injection countermeasure to mitigate the attack in cloud environments.

Recommended citation: D. R. Dipta, T. Tiemann, B. Gulmezoglu, E. Marin and T. Eisenbarth, "Dynamic Frequency-Based Fingerprinting Attacks against Modern Sandbox Environments," 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P), pp. 327-344, Vienna, Austria, 2024.
Download Paper