Mengjia Yan

MIT EECS associate professor and CSAIL principal investigator researching computer architecture and hardware security, with a focus on side-channel attacks, microarchitectural vulnerabilities, and processor defenses. She co-authored TONTOU, which examines the exploitability of time-of-neutralization to time-of-use windows.

TONTOU Exploits a Timing Gap in Spectre Mitigations

MIT CSAIL researchers Daniel Trujillo and Mengjia Yan argue that processor defenses against Spectre can fail in the brief interval after a bad prediction is neutralized but before it is fully prevented from influencing execution. Their TONTOU attack uses carefully timed interrupts and cache delays to reopen that path, allowing a new speculative misprediction that can expose protected data. In a demonstration on affected AMD Zen processors, the team leaked password-hash data from the protected `/etc/shadow` file.

MIT CSAILAug 19, 20264 min read