{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/121444"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/121444","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Logs and side channels","abstract":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2023-12-04 without embargo terms","abstract_html":"Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2023-12-04 without embargo terms","abstract_has_math":false,"creators":["Lee, Hyun Bin"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"Ph.D.","degree_level":"Dissertation","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Gunter, Carl A","Fletcher, Chris W","Bates, Adam","Borisov, Nikita","Pierson, Timothy J"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2023,"date_issued":"2023-08","date_published":"2023-08","updated_at":"2026-07-22T22:24:57Z","subjects":["System Logs","Microarchitectural Side Channels","Data-oblivious Computation","Trusted Execution Environments"],"languages":["en","eng"],"rights":["Copyright 2023 Hyun Bin Lee"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/2142/121444","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Gunter, Carl A","Fletcher, Chris W","Bates, Adam","Borisov, Nikita","Pierson, Timothy J"]},{"key":"dc:creator","label":"Author","values":["Lee, Hyun Bin"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2023-08","2023-07-05"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Ph.D."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["System Logs","Microarchitectural Side Channels","Data-oblivious Computation","Trusted Execution Environments"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en","eng"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2023 Hyun Bin Lee"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://hdl.handle.net/2142/121444"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2023-12-04 without embargo terms","The student, Hyun Bin Lee, accepted the attached license on 2023-06-30 at 11:21.","The student, Hyun Bin Lee, submitted this Dissertation for approval on 2023-06-30 at 11:46.","This Dissertation was approved for publication on 2023-07-05 at 15:28.","DSpace SAF Submission Ingestion Package generated from Vireo submission #19488 on 2023-12-04 at 17:00:22","While system administrators would prefer to configure their systems so that their loggers capture as much details as possible, such details may include sensitive information. In particular, system audit logs aim to record information about system events that are triggered during any incident. Hence they inevitably contain sensitive information that needs to be kept secret. Redacting and obfuscating such information may help when such information is written explicitly on logs, but implicit information, content that is seemingly not secret but indirectly leaks secret information, cannot be handled with such measures. Unfortunately, researchers have overlooked risks of leaking implicit secret content. This thesis first introduces Termite attacks, a new class of side channel attack that exploits such implicit content to learn secret information. We demonstrate how logs can be used to create both membership inference attacks and keystroke timing attacks, and show practical exploits against a common setup: a LEMP (Linux, ENginx, MySQL, PHP) webserver with SSH daemon that is audited by the Linux Audit System (LAS). Then we demonstrate how to launch a concurrency-based timing side channel attack. Contrary to the belief that log information is too coarse-grained to be exploited against modern microarchitectural side channel attacks, we demonstrate how adversaries can craft timing side channels that are as fine as 100s of nanoseconds through system audit logs. To address such vulnerabilities associated with logs leaking sensitive information via microarchitectural side channels, we propose two different countermeasure schemes. First scheme involves data-oblivious computation and Trusted Execution Environments (TEEs) against adversarial systems. We demonstrate how to produce a side-channel resistant log by instrumenting a complex programming environment (like R) to produce a Data-Oblivious Transcript (DOT). The DOT is designed so that any sensitive data from computation is decoupled from the transcript. Such transcript is later evaluated on a TEE containing the sensitive data using a small trusted computing base called the Data-Oblivious Virtual Environment (DOVE). While DOVE allows us to protect logs, deploying DOVE requires several prerequisites. In particular, another countermeasure is needed when one cannot completely decouple timing information from logs. As we have shown how to exploit such timing information to steal secrets from Termite attacks, our last study investigates how to mitigate such attack vector against aforementioned system audit logs stored on honest system that adversaries temporarily break-in. This study observes tradeoffs between the number of timestamps in logs versus the utility of audit logs. We analyze existing utility functions associated with audit logs and choose a reachability function as a utility standard for this study. We use DARPA's Trusted Computing Dataset for this study to conduct experiments. In order to guarantee complete security against timing side channels, the logs must not contain any timing information such that no timestamp exists and the ordering of all log entries are randomized. We call such logs Timeless Logs. Unfortunately our reachability analysis showed such extreme measures lead to very poor utility according to our experiments against the dataset. Hence, we introduce an alternative method, Batched Timeless Logs. This method divides logs into n batches and make each batch timeless. We preserve ordering among batches, so there are n different time information stored in the logs. The size of each batch is randomized to augment security against clock-edge attacks between batches. Our experimentation on a public dataset shows that when batches are sufficiently small (batch size of around 1,000 entries or smaller), there is only an 1.47 percent increase in the number of false positive reachable nodes from randomly picked source nodes on average. We argue that side-channel attacks against logs can leak very fine-grained information across any vulnerable application but such threats have been overlooked. Our study on such attacks and proposed countermeasures highlights some future work that should to be addressed."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Logs and side channels"]}]}],"canonical_facts":{"dc:contributor":["Gunter, Carl A","Fletcher, Chris W","Bates, Adam","Borisov, Nikita","Pierson, Timothy J"],"dc:creator":["Lee, Hyun Bin"],"dc:date":["2023-08","2023-07-05"],"dc:description":["Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2023-12-04 without embargo terms","The student, Hyun Bin Lee, accepted the attached license on 2023-06-30 at 11:21.","The student, Hyun Bin Lee, submitted this Dissertation for approval on 2023-06-30 at 11:46.","This Dissertation was approved for publication on 2023-07-05 at 15:28.","DSpace SAF Submission Ingestion Package generated from Vireo submission #19488 on 2023-12-04 at 17:00:22","While system administrators would prefer to configure their systems so that their loggers capture as much details as possible, such details may include sensitive information. In particular, system audit logs aim to record information about system events that are triggered during any incident. Hence they inevitably contain sensitive information that needs to be kept secret. Redacting and obfuscating such information may help when such information is written explicitly on logs, but implicit information, content that is seemingly not secret but indirectly leaks secret information, cannot be handled with such measures. Unfortunately, researchers have overlooked risks of leaking implicit secret content. This thesis first introduces Termite attacks, a new class of side channel attack that exploits such implicit content to learn secret information. We demonstrate how logs can be used to create both membership inference attacks and keystroke timing attacks, and show practical exploits against a common setup: a LEMP (Linux, ENginx, MySQL, PHP) webserver with SSH daemon that is audited by the Linux Audit System (LAS). Then we demonstrate how to launch a concurrency-based timing side channel attack. Contrary to the belief that log information is too coarse-grained to be exploited against modern microarchitectural side channel attacks, we demonstrate how adversaries can craft timing side channels that are as fine as 100s of nanoseconds through system audit logs. To address such vulnerabilities associated with logs leaking sensitive information via microarchitectural side channels, we propose two different countermeasure schemes. First scheme involves data-oblivious computation and Trusted Execution Environments (TEEs) against adversarial systems. We demonstrate how to produce a side-channel resistant log by instrumenting a complex programming environment (like R) to produce a Data-Oblivious Transcript (DOT). The DOT is designed so that any sensitive data from computation is decoupled from the transcript. Such transcript is later evaluated on a TEE containing the sensitive data using a small trusted computing base called the Data-Oblivious Virtual Environment (DOVE). While DOVE allows us to protect logs, deploying DOVE requires several prerequisites. In particular, another countermeasure is needed when one cannot completely decouple timing information from logs. As we have shown how to exploit such timing information to steal secrets from Termite attacks, our last study investigates how to mitigate such attack vector against aforementioned system audit logs stored on honest system that adversaries temporarily break-in. This study observes tradeoffs between the number of timestamps in logs versus the utility of audit logs. We analyze existing utility functions associated with audit logs and choose a reachability function as a utility standard for this study. We use DARPA's Trusted Computing Dataset for this study to conduct experiments. In order to guarantee complete security against timing side channels, the logs must not contain any timing information such that no timestamp exists and the ordering of all log entries are randomized. We call such logs Timeless Logs. Unfortunately our reachability analysis showed such extreme measures lead to very poor utility according to our experiments against the dataset. Hence, we introduce an alternative method, Batched Timeless Logs. This method divides logs into n batches and make each batch timeless. We preserve ordering among batches, so there are n different time information stored in the logs. The size of each batch is randomized to augment security against clock-edge attacks between batches. Our experimentation on a public dataset shows that when batches are sufficiently small (batch size of around 1,000 entries or smaller), there is only an 1.47 percent increase in the number of false positive reachable nodes from randomly picked source nodes on average. We argue that side-channel attacks against logs can leak very fine-grained information across any vulnerable application but such threats have been overlooked. Our study on such attacks and proposed countermeasures highlights some future work that should to be addressed."],"dc:format":["application/pdf"],"dc:identifier":["https://hdl.handle.net/2142/121444"],"dc:language":["en","eng"],"dc:rights":["Copyright 2023 Hyun Bin Lee"],"dc:subject":["System Logs","Microarchitectural Side Channels","Data-oblivious Computation","Trusted Execution Environments"],"dc:title":["Logs and side channels"],"dc:type":["text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Ph.D."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:24:57Z"}