Researchers from numerous American universities have discovered that nearly every contemporary graphics processing units (GPUs) are vulnerable to a brand-new kind of side-channel attack that could be employed to steal sensitive information.
GPU.zip is a novel attack method discovered and reported by representatives from the University of Texas at Austin, Carnegie Mellon University, the University of Washington, and the University of Illinois Urbana-Champaign.
The GPU.zip attack employs hardware-based graphical data compression, an optimization in modern GPUs that is created for enhancing performance.
"GPU.zip exploits software-transparent uses of compression. This is in contrast to prior compression side channels, which leak because of software-visible uses of compression and can be mitigated by disabling compression in software,” the researchers stated.
GPU.zip can be used to compromise a device by tricking the targeted user into visiting a malicious website, unlike many other recently revealed side-channel attacks that require physical access to the target device. Through this technique, the attacker's website is able to steal data from other websites that the victim is actively visiting.
The method can specifically be used by the malicious website to steal individual pixels from another site that is open at the same time. This allows for the theft of visible information on the screen, such as usernames, which can be exploited to deanonymize a user.
While most websites that save sensitive information are designed to avoid this type of leakage, certain popular sites are still vulnerable.
The researchers demonstrated the attack through stealing the targeted individual's username, which is displayed in the upper right corner of Wikipedia. It is worth mentioning, however, that obtaining the information via a GPU.zip attack takes a significant amount of time.
The researchers' two experiments took 30 minutes and 215 minutes to establish the Wikipedia login.
Nevertheless, developers should verify that their websites are not vulnerable by configuring them to refuse being integrated by sites from other domains.
In March 2023, AMD, Apple, Arm, Intel, Nvidia, and Qualcomm were given information on the discoveries and proof-of-concept (PoC) code, but none of them had committed to releasing updates by September 2023.
The attack has been demonstrated to operate with the Chrome web browser. Other popular browsers, such as Safari and Firefox, are unaffected. Google was also alerted about the potential risk in March 2023, but the internet giant is currently debating whether and how to fix the issue, the researchers added.
