  Information leaks are a significant problem in modern computer systems and
string manipulation is prevalent in modern software. We present techniques for
automated synthesis of side-channel attacks that recover secret string values
based on timing observations on string manipulating code. Our attack synthesis
techniques iteratively generate inputs which, when fed to code that accesses
the secret, reveal partial information about the secret based on the timing
observations, leading to recovery of the secret at the end of the attack
sequence. We use symbolic execution to extract path constraints, automata-based
model counting to estimate the probability of execution paths, and
meta-heuristic methods to maximize information gain based on entropy for
synthesizing adaptive attack steps.
