4 ms·

These kinds of brownout/undervolt attacks have been used in console cracking for decades. Surely someone involved would have known about that. I wonder what ch

These kinds of brownout/undervolt attacks have been used in console cracking for decades. Surely someone involved would have known about that. I wonder what chain of events led to the creation of a secure enclave with such well understood flaws.

baybal2 7y ago
> Surely someone involved would have known about that. I wonder what chain of events led to the creation of a secure enclave with such well understood flaws. Don't you think that most engineers will just laugh the idea off, and do just enough to make their PMs happy? Such nebulous concepts as "secure enclave" only exist in imagination of MBA types. Even the name "enclave" sounds like it was picked by a seasoned talkshop person.
- HoochTHX 7y ago
  Naw. It's just the same age old issue of someone writing the design specs with the illusion it will be followed. Instead of designing it so that they can't not be followed.
bradstewart 7y ago
While the premise is similar, this is much different from the decades old brownout attacks. The researchers are causing the undervolt with software, not by manipulating the supply lines to the chip.
- missosoup 7y ago
  Yes but not really? Intel just made it easier than oldschool hardware attacks: > adversary abuses an undocumented Intel Core voltage scaling interface Instead of having to buy hardware to mess with the power rail in a controlled manner, you can now just do it with a code snippet!
  - bradstewart 7y ago
    And you can do it remotely. But the certainly made it easier because this is (presumably) behind the brownout detectors and other circuitry usually attached to the supply lines to combat this sort of stuff.
- Taek 7y ago
  One of the major elements of a TEE is that I can send code to an untrusted party and expect it to be executed faithfully. Under that model I have to assume that they have physical access to their own hardware and could do hardware based attacks. Which means the model is just as broken even without it being a software attack.

baybal2 7y ago

> Surely someone involved would have known about that. I wonder what chain of events led to the creation of a secure enclave with such well understood flaws. Don't you think that most engineers will just laugh the idea off, and do just enough to make their PMs happy? Such nebulous concepts as "secure enclave" only exist in imagination of MBA types. Even the name "enclave" sounds like it was picked by a seasoned talkshop person.

HoochTHX 7y ago
Naw. It's just the same age old issue of someone writing the design specs with the illusion it will be followed. Instead of designing it so that they can't not be followed.

bradstewart 7y ago

While the premise is similar, this is much different from the decades old brownout attacks. The researchers are causing the undervolt with software, not by manipulating the supply lines to the chip.

missosoup 7y ago
Yes but not really? Intel just made it easier than oldschool hardware attacks: > adversary abuses an undocumented Intel Core voltage scaling interface Instead of having to buy hardware to mess with the power rail in a controlled manner, you can now just do it with a code snippet!
- bradstewart 7y ago
  And you can do it remotely. But the certainly made it easier because this is (presumably) behind the brownout detectors and other circuitry usually attached to the supply lines to combat this sort of stuff.
Taek 7y ago
One of the major elements of a TEE is that I can send code to an untrusted party and expect it to be executed faithfully. Under that model I have to assume that they have physical access to their own hardware and could do hardware based attacks. Which means the model is just as broken even without it being a software attack.