Barnowld - Daemon for live detection of cache side-channel attacks

Hacker News

The idea behind barnowld is that cache side channel attacks almost always leave a very special signature: they usually generate cache miss rates above 90% which have nothing in common with "natural" applications. It is precisely this conspicuous characteristics that barnwold takes advantage of. Mode of operation: the daemon iterates over the cores and analyzes them individually for a random amount of seconds. After all cores are analyzed, it starts again. For analyzing, the CPU Performance Monitoring Unit (PMU) is used in counting mode. This approach has effectively no overhead and is through the Linux perf subsystem extremely generic usable for the various architectures such as x86-64, ARM, IBM or RISC-V. If potential attacks are detected, an alarm message is logged into the journal with severity error. Third party log analyzer can simply filter for error messages in unit barnowld. Of course, it can not prevent attacks - microcode updates from the vendors should always be installed preferentially - no question! The daemon is used to detect attacks which are known - or not yet known. I am grateful for criticism or ideas!

Visit product View on Hacker NewsSep 28, 2023

Share card

Actual performance

1points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Hacker NewsStrong engagement from HN community · Strong signals: ide, io · Missing: https docs, excited, just released

53%53% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

51%51% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

Product HuntUnlikely to reach the leaderboard · Strong signals: code · Missing: mac, agents, macos

44%44% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: way · Missing: mobile apps, ios, personal

32%32% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

31%31% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

14%14% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

9%9% predicted probability of success on BetaList, based on ML models trained on real launch data.

Incorrect prediction on native model

Similar products

DDoS detection in 0.9s, tested against a 48 Gbps attack live57%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

DDoS detection in 0.9s, tested against a 48 Gbps attack live

Hacker News15

((

((qKast)): Broadcast Your Channel ::36%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

((qKast)): Broadcast Your Channel ::

Hacker News1

Channel Totals36%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Channel Totals

Hacker News4

Extended Isolation Forest for anomaly detection37%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Extended Isolation Forest for anomaly detection

Hacker News22

RCE Detection59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

RCE Detection

Hacker News1

Anomaly Detection in Ruby52%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Anomaly Detection in Ruby

Hacker News24

Anomaly Detection with Bytewax and Redpanda59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Anomaly Detection with Bytewax and Redpanda

Hacker News3

Go-nude – Nudity detection with Go59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Go-nude – Nudity detection with Go

Hacker News16

Chkbit bitrot detection59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Chkbit bitrot detection

Hacker News2

Refreak12%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

FACEIT Smurf detection and grenade lineups

Product Hunt+3

Browse all products Analyze your launch