This is attack was the natural extension of Ristenpart et al's "prime, trigger and probe" attack [1], which looks like this:
(1) Prime: Read B at s-byte offsets in order to ensure it is
cached.
(2) Trigger: Busy-loop until the CPU’s cycle counter jumps
by a large value. (This means our VM was preempted by
the Xen scheduler, hopefully in favor of the sender VM.)
(3) Probe: Measure the time it takes to again read B at
s-byte offsets.
The idea is that if the co-resident VM's level of activity will increase the time it takes to read B (because the other VM cleared the CPU cache).
When they first published this, they noted that stealing cryptographic keys in a context like EC2 seemed impractical, saying "In practice, cryptographic cross-VM attacks turn out to be somewhat more difficult to realize due to factors such as core migration, coarser scheduling algorithms, double indirection of memory addresses, and
(in the case of EC2) unknown load from other instances and a fortuitous choice of CPU configuration (e.g. no hyperthreading)."
It's really cool to see that they finally successfully implemented it.
(1) Prime: Read B at s-byte offsets in order to ensure it is cached.
(2) Trigger: Busy-loop until the CPU’s cycle counter jumps by a large value. (This means our VM was preempted by the Xen scheduler, hopefully in favor of the sender VM.)
(3) Probe: Measure the time it takes to again read B at s-byte offsets.
The idea is that if the co-resident VM's level of activity will increase the time it takes to read B (because the other VM cleared the CPU cache).
When they first published this, they noted that stealing cryptographic keys in a context like EC2 seemed impractical, saying "In practice, cryptographic cross-VM attacks turn out to be somewhat more difficult to realize due to factors such as core migration, coarser scheduling algorithms, double indirection of memory addresses, and (in the case of EC2) unknown load from other instances and a fortuitous choice of CPU configuration (e.g. no hyperthreading)."
It's really cool to see that they finally successfully implemented it.
[1]http://cseweb.ucsd.edu/~hovav/dist/cloudsec.pdf (PDF)