4 ms·

Terrible for those of us who use undervolting to keep their laptop as cool as possible. I hope they allow it enabled in the bios settings.

by xioxox 7y ago

jotm 7y ago
FWIW, SGX is in Skylake and later. Time for AMD to shine I guess
- baq 7y ago
  the paper mentions TrustZone has (had?) similar issues: > In 2017, Tang et al. [65] discovered a software-based fault attack, dubbed CLK screw. They discovered that ARM processors allow configuration of the dynamic frequency scaling feature, i.e., overclocking, by system software. Tang et al. show that overclocking features may be abused to jeopardize the integrity of computations for privileged adversaries in a Trusted Execution Environment (TEE). Based on this observation, they were able to attack cryptographic code running in TrustZone. They used their attack to extract cryptographic keys from a custom AES software implementation and to overcome RSA signature checks and subsequently execute their own program in the TrustZone of the System-on-Chip (SoC) on a Nexus 6 device. it further notes though: > However, their attack is specific to TrustZone on a certain ARM SoC and not directly applicable to SGX on Intel processors. (ARM TrustZone is what AMD has in their chips)
  - antpls 7y ago
    I did a quick search on the paper, didn't find "google" nor "titan", which is the secure chip made by Google. Would it be vulnerable too?
  - qiqitori 7y ago
    > (ARM TrustZone is what AMD has in their chips) Well, I'll be damned: "The PSP itself is an ARM core inserted on the main CPU.[6]" (https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...) I'd imagine that the ARM core on the AMD CPU doesn't support changing the clock rate or anything much though.
    - AstralStorm 7y ago
      Even if it does, you cannot execute unattested code on it and the voltage is pegged to CPU IO voltage. Undervolting that risks big fat immediate system crash, unlike undervolting a core.
strstr 7y ago
"After carefully reviewing the CPU voltage setting modification, Intel is mitigating the issue in two parts, a BIOS patch to disable the overclocking mailbox interface configuration. Secondly, a microcode update will be released that reflects the mailbox enablement status as part of SGX TCB [Trusted Computing Base] attestation. The Intel Attestation Service (IAS) and the Platform Certificate Retrieval Service will be updated with new keys in due course. The IAS users will receive a ‘CONFIGURATION NEEDED’ message from platforms that do not disable the overclocking mailbox interface.” Seems like you should be able to just avoid applying the bios patch. That said, you won't be able to keep your BIOS up to date.
- chithanh 7y ago
  But then again, the researchers state: "In the paper, we show that Plundervolt may affect SGX's attestation functionality" so they are apparently able to fake at least part of the attestation. Also it will be interesting to see whether directly talking to the voltage regulation controller on the mobo will circumvent the microcode protection.
  - wahern 7y ago
    AFAICT, they were able to randomly flip bits in the enclave. Which isn't great, but doesn't yet break remote attestation as commonly used for DRM schemes, which involves online communication with both Intel and the enclave software provider. They can simply reject attestations if they detect too many authentication attempts from the same CPU, long before you manage to flip the correct bit. IIRC, reading memory out of the enclave has already been accomplished with other side-channel attacks, so that aspect has been broken. What would be novel is if you could read the per-CPU secret key[1], but that doesn't appear to be what they've done. [1] Which only Intel knows, which is why remote attestation requires a service contract with Intel for online verification of attestation responses.
  - segfaultbuserr 7y ago
    > whether directly talking to the voltage regulation controller on the mobo Is it even possible to do that without physical access? Can you confirm that? Do modern motherboards expose an interface that allows directly control over the voltage regulation in software without physical access?! If so, it's terrifying...

Terrible for those of us who use undervolting to keep their laptop as cool as possible. I hope they allow it enabled in the bios settings.

by xioxox 7y ago

Terrible for those of us who use undervolting to keep their laptop as cool as possible. I hope they allow it enabled in the bios settings.

jotm 7y ago

FWIW, SGX is in Skylake and later. Time for AMD to shine I guess

baq 7y ago
the paper mentions TrustZone has (had?) similar issues: > In 2017, Tang et al. [65] discovered a software-based fault attack, dubbed CLK screw. They discovered that ARM processors allow configuration of the dynamic frequency scaling feature, i.e., overclocking, by system software. Tang et al. show that overclocking features may be abused to jeopardize the integrity of computations for privileged adversaries in a Trusted Execution Environment (TEE). Based on this observation, they were able to attack cryptographic code running in TrustZone. They used their attack to extract cryptographic keys from a custom AES software implementation and to overcome RSA signature checks and subsequently execute their own program in the TrustZone of the System-on-Chip (SoC) on a Nexus 6 device. it further notes though: > However, their attack is specific to TrustZone on a certain ARM SoC and not directly applicable to SGX on Intel processors. (ARM TrustZone is what AMD has in their chips)
- antpls 7y ago
  I did a quick search on the paper, didn't find "google" nor "titan", which is the secure chip made by Google. Would it be vulnerable too?
- qiqitori 7y ago
  > (ARM TrustZone is what AMD has in their chips) Well, I'll be damned: "The PSP itself is an ARM core inserted on the main CPU.[6]" (https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor https://en.wikipedia.org/wiki/AMD_Platform_Security_Processo...) I'd imagine that the ARM core on the AMD CPU doesn't support changing the clock rate or anything much though.
  - AstralStorm 7y ago
    Even if it does, you cannot execute unattested code on it and the voltage is pegged to CPU IO voltage. Undervolting that risks big fat immediate system crash, unlike undervolting a core.

strstr 7y ago

"After carefully reviewing the CPU voltage setting modification, Intel is mitigating the issue in two parts, a BIOS patch to disable the overclocking mailbox interface configuration. Secondly, a microcode update will be released that reflects the mailbox enablement status as part of SGX TCB [Trusted Computing Base] attestation. The Intel Attestation Service (IAS) and the Platform Certificate Retrieval Service will be updated with new keys in due course. The IAS users will receive a ‘CONFIGURATION NEEDED’ message from platforms that do not disable the overclocking mailbox interface.” Seems like you should be able to just avoid applying the bios patch. That said, you won't be able to keep your BIOS up to date.

chithanh 7y ago
But then again, the researchers state: "In the paper, we show that Plundervolt may affect SGX's attestation functionality" so they are apparently able to fake at least part of the attestation. Also it will be interesting to see whether directly talking to the voltage regulation controller on the mobo will circumvent the microcode protection.
- wahern 7y ago
  AFAICT, they were able to randomly flip bits in the enclave. Which isn't great, but doesn't yet break remote attestation as commonly used for DRM schemes, which involves online communication with both Intel and the enclave software provider. They can simply reject attestations if they detect too many authentication attempts from the same CPU, long before you manage to flip the correct bit. IIRC, reading memory out of the enclave has already been accomplished with other side-channel attacks, so that aspect has been broken. What would be novel is if you could read the per-CPU secret key[1], but that doesn't appear to be what they've done. [1] Which only Intel knows, which is why remote attestation requires a service contract with Intel for online verification of attestation responses.
- segfaultbuserr 7y ago
  > whether directly talking to the voltage regulation controller on the mobo Is it even possible to do that without physical access? Can you confirm that? Do modern motherboards expose an interface that allows directly control over the voltage regulation in software without physical access?! If so, it's terrifying...