Introduction to Software Side Channels and Mitigations
EN
Kommande
Introduction to Software Side Channels and Mitigations

Introduction to Software Side Channels and Mitigations

Graz University of Technology

Daniel Gruß

Om

Varaktighet 5 units
Enhet 2 hours/unit
Licens CC BY 4.0
Tillgänglighet Obegränsad
Startdatum 3 november 2025
Kostnader € 0.00

Innehåll

Kursinnehåll

Side channels exist in the real world, but they also exist in computers and can be exploited directly from software. This is a substantial computer security problem today, that we need to learn about to be able to stop attacks. In this course, you will learn and practice basic software-based side channels and understand the thought process to utilize a side channel. You will then learn how to mitigate or avoid side channels in software.


Kursmål

After completing this course, you will:

  • be able to spot side-channel leakage in simple programs
  • be able to use software-based side channels to extract secret information
  • be able to connect these security risks with methods to mitigate and close side channels in software

Förkunskaper

No formal prerequisites, but it is expected that you already have started to build up your side-channel security mindset, for instance via the corresponding iMooX course.


Kursförlopp

There are 5 parts (episodes+exercises) in this course:

- Episode 1: Raiders of the Lost Account

Manuel loses access to his online account. In a search to recover it, the flat mates discover how to get from small variations in the execution to a side-channel attack on the PIN entry.

- Episode 2: Memory

Claudio runs a course grading server. Our flat mates set out to find a flaw in it and discover a new means of attacking software, by flushing and reloading memory (the so-called Flush+Reload attack).

- Episode 3: Not on my Watch

Lukas and Andreas miss a deadline and use Flush+Reload to still get a signature on their assignments even though the deadline has passed.

- Episode 4: Justice Leak

Claudio's course grading server corrupts an assignment, leading to an unfair zero points for some flat mates. They try to get justice and their points back, by using Flush+Reload again.

- Episode 5: Flush+Reload: Endgame

With all these attacks, and specific mitigations against them, the flatmates discuss possible generic mitigations against Flush+Reload.


Intyg

For actively participating in the course you will receive an automatic certificate which includes your name, the course name as well as the completed lessons. We want to point out that this certificate merely confirms that you answered at least 75% of the self-assessment questions correctly.

Licens

This work is licensed under CC BY 4.0

Discussion

If you prefer a more instant means of communication compared to the iMooX forum, you can join our official community on Discord. Just visit https://discord.gg/rrbazVdAN9 and join SCS's Discord server!

Discussion Guidelines

Both Discord and the discussion forums are where you can express thoughts, develop ideas, and engage with classmates and instructors. Please review discussion postings before posting your own to avoid redundancy. When adding a forum post, mark it as a Question or a Discussion. Questions raise issues that need answers, whereas Discussions share ideas and start conversations. Do not post solutions or links to solutions to quiz questions or homework assignments anywhere. Give your message a meaningful title. Use common writing practices for online communication. Participation on Discord and in the discussion forums is voluntary, but we encourage participation to get to know everyone else taking the course. We, the instructors and TAs, will answer your questions on both platforms of course.

Academic Policy

The course follows the academic policy of TU Graz.

Kursinstruktör

Daniel Gruß
Daniel Gruß

Daniel Gruss (@lavados) is a University Professor at Graz University of Technology. He loves teaching and research of system-level topics, including side channels and transient execution attacks. He implemented the first remote fault attack running in a website, known as Rowhammer.js. His research team was one of the teams that found the Meltdown and Spectre bugs, published in early 2018. In 2023, he received an ERC Starting Grant to research the sustainability of security. He frequently speaks at top international venues.

Logga in & registrera Kursen startar 3 november 2025. För närvarande: 0 Deltagare

Gratis för alla € 0.00

Partners

Graz University of Technology

Graz University of Technology

Graz

21689 Deltagare
75 Kurser
Genomsnittligt omdöme

Betyg

Introduction to Software Side Channels and Mitigations

5 stjärnor
0
4 stjärnor
0
3 stjärnor
0
2 stjärnor
0
1 stjärnor
0