“Termite Attacks: Gnawing on Logs to Extract Secret Information”, by Hyun Bin Lee et. al., uncovers a hidden risk in system audit logs. Logs record system events for use during incident response, and in doing so store sensitive information that preferably stays secret. In particular, the paper emphasizes “implicit secret content”: content that is seemingly not secret but indirectly leaks secret information.
The authors introduce Termite attacks, a new class of side-channel attack that exploits implicit content to learn secret information. Exemplifying three unique cases, they show how logs can be exploited by indirect inferences that produce significant side channels, including membership inference attacks and keystroke timing attacks.
The authors further demonstrate a concurrency-based side-channel attack. Contrary to the belief that log information is too coarse-grained to be exploited by modern microarchitectural side-channel attacks, they show adversaries can craft timing side channels as fine as hundreds of nanoseconds through system audit logs. Their proof-of-concept NetSpectre attack steals a secret bit in 470 seconds with an 81.25% success rate using just 12 memory loads.
To learn more, read the paper. To receive notification of SPLICE news, subscribe to this blog!
Bin Lee, H., Jois, T. M., Fletcher, C. W., & Gunter, C. A. (2025). Termite Attacks: Gnawing on Logs to Extract Secret Information. IEEE International Symposium on Hardware Oriented Security and Trust (HOST), 415–426. https://doi.org/10.1109/HOST64725.2025.11050066
SPLICE 
Leave a comment