publications

2024

1. Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor

   Hosein Yavarzadeh, Archit Agarwal, Max Christman, Christina Garman, Daniel Genkin, Andrew Kwong, Daniel Moghimi, Deian Stefan, Kazem Taram, and Dean Tullsen

   In 2024 ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), 2024

   Abs Bib PDF

   This paper introduces novel attack primitives that enable adversaries to leak (read) and manipulate (write) the path history register (PHR) and the prediction history tables (PHTs) of the conditional branch predictor in high-performance CPUs. These primitives enable two new classes of attacks: first, it can recover the entire control flow history of a victim program by exploiting read primitives, as demonstrated by a practical secret-image recovery based on capturing the entire control flow of libjpeg routines. Second, it can launch extremely high-resolution transient attacks by exploiting write primitives. We demonstrate this with a key recovery attack against AES based on extracting intermediate values.

   @inproceedings{Pathfinder,
     author = {Yavarzadeh, Hosein and Agarwal, Archit and Christman, Max and Garman, Christina and Genkin, Daniel and Kwong, Andrew and Moghimi, Daniel and Stefan, Deian and Taram, Kazem and Tullsen, Dean},
     booktitle = {2024 ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS)},
     title = {Pathfinder: High-Resolution Control-Flow Attacks Exploiting the Conditional Branch Predictor},
     year = {2024},
     volume = {3},
     number = {},
     pages = {770-784},
     doi = {10.1145/3620666.3651382},
     image = {},
   }

2022

1. A Metric for Finding Robust Start Positions for Medical Steerable Needle Automation

   Janine Hoelscher, Inbar Fried, Mengyu Fu, Mihir Patwardhan, Max Christman, Jason Akulian, Robert J. Webster, and Ron Alterovitz

   In 2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), 2022

   Abs Bib PDF

   Steerable needles are medical devices with the ability to follow curvilinear paths to reach targets while circumventing obstacles. In the deployment process, a human operator typically places the steerable needle at its start position on a tissue surface and then hands off control to the automation that steers the needle to the target. Due to uncertainty in the placement of the needle by the human operator, choosing a start position that is robust to deviations is crucial since some start positions may make it impossible for the steerable needle to safely reach the target. We introduce a method to efficiently evaluate steerable needle motion plans such that they are safe to variation in the start position. This method can be applied to many steerable needle planners and requires that the needle’s orientation angle at insertion can be robotically controlled. Specifically, we introduce a method that builds a funnel around a given plan to determine a safe insertion surface corresponding to insertion points from which it is guaranteed that a collision-free motion plan to the goal can be computed. We use this technique to evaluate multiple feasible plans and select the one that maximizes the size of the safe insertion surface. We evaluate our method through simulation in a lung biopsy scenario. This simulation shows that our funnel method is able to quickly find needle plans with a large safe insertion surface.

   @inproceedings{Needle,
     author = {Hoelscher, Janine and Fried, Inbar and Fu, Mengyu and Patwardhan, Mihir and Christman, Max and Akulian, Jason and Webster, Robert J. and Alterovitz, Ron},
     booktitle = {2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)},
     title = {A Metric for Finding Robust Start Positions for Medical Steerable Needle Automation},
     year = {2022},
     volume = {},
     number = {},
     pages = {9526-9533},
     doi = {10.1109/IROS47612.2022.9982227},
     image = {needle.png},
   }