3 ms·

there is no way to "highly isolate" a VM from a host.

• lostmsu 9y ago
  But there is (though I think they don't use it): TPM based host attestation.
  • throwaway2048 9y ago
    The microsoft secureboot golden key got leaked, anything based on secureboot as a root of trust is 100% blown wide open. https://web.archive.org/web/20170604013028/https://rol.im/securegoldenkeyboot/ https://web.archive.org/web/20170604013028/https://rol.im/se...
    • JensRex 9y ago
      If you don't want to claw your eyes out while reading: https://bpaste.net/show/571ef50296ac https://bpaste.net/show/571ef50296ac
    • lostmsu 9y ago
      I am not sure this depends on TPM. Care to share a link?
• q3k 9y ago
  Theoretically possible via SGX.
  • mmozeiko 9y ago
    Which can be defeated with SgxSpectre: https://arxiv.org/abs/1802.09085 https://arxiv.org/abs/1802.09085
    • snuxoll 9y ago
      Oh goodie, I wonder if Netflix is going to disable 4K support on PC as a result of this (the requirement for Skylake was due to SGX).
  • gruez 9y ago
    Worthless if the GPU doesn't have something similar. Otherwise you can monitor the pci-e lanes for all the data the cpu is sending over to the gpu.
• deleted 9y ago
  [deleted]
• deleted 9y ago
  [deleted]