  In the last 10 years, cache attacks on Intel x86 CPUs have gained increasing
attention among the scientific community and powerful techniques to exploit
cache side channels have been developed. However, modern smartphones use one or
more multi-core ARM CPUs that have a different cache organization and
instruction set than Intel x86 CPUs. So far, no cross-core cache attacks have
been demonstrated on non-rooted Android smartphones. In this work, we
demonstrate how to solve key challenges to perform the most powerful cross-core
cache attacks Prime+Probe, Flush+Reload, Evict+Reload, and Flush+Flush on
non-rooted ARM-based devices without any privileges. Based on our techniques,
we demonstrate covert channels that outperform state-of-the-art covert channels
on Android by several orders of magnitude. Moreover, we present attacks to
monitor tap and swipe events as well as keystrokes, and even derive the lengths
of words entered on the touchscreen. Eventually, we are the first to attack
cryptographic primitives implemented in Java. Our attacks work across CPUs and
can even monitor cache activity in the ARM TrustZone from the normal world. The
techniques we present can be used to attack hundreds of millions of Android
devices.
