  In this work, we explore the applicability of cache occupancy attacks and the
implications of secured cache design rationales on such attacks. In particular,
we show that one of the well-known cache randomization schemes, MIRAGE, touted
to be resilient against eviction-based attacks, amplifies the chances of cache
occupancy attack, making it more vulnerable compared to contemporary designs.
We leverage MIRAGE's global eviction property to demonstrate covert channel
with byte-level granularity, with far less cache occupancy requirement (just
$10\%$ of LLC) than other schemes. For instance, ScatterCache (a randomisation
scheme with lesser security guarantees than MIRAGE) and generic set-associative
caches require $40\%$ and $30\%$ cache occupancy, respectively, to exhibit
covert communication. Furthermore, we extend our attack vectors to include
side-channel, template-based fingerprinting of workloads in a cross-core
setting. We demonstrate the potency of such fingerprinting on both inhouse LLC
simulator as well as on SPEC2017 workloads on gem5. Finally, we pinpoint
implementation inconsistencies in MIRAGE's publicly available gem5 artifact
which motivates a re-evaluation of the performance statistics of MIRAGE with
respect to ScatterCache and baseline set-associative cache. We find MIRAGE, in
reality, performs worse than what is previously reported in literature, a
concern that should be addressed in successor generations of secured caches.
