AFAICT, they were able to randomly flip bits in the enclave. Which isn't great, but doesn't yet break remote attestation as commonly used for DRM schemes, which

AFAICT, they were able to randomly flip bits in the enclave. Which isn't great, but doesn't yet break remote attestation as commonly used for DRM schemes, which involves online communication with both Intel and the enclave software provider. They can simply reject attestations if they detect too many authentication attempts from the same CPU, long before you manage to flip the correct bit. IIRC, reading memory out of the enclave has already been accomplished with other side-channel attacks, so that aspect has been broken. What would be novel is if you could read the per-CPU secret key[1], but that doesn't appear to be what they've done. [1] Which only Intel knows, which is why remote attestation requires a service contract with Intel for online verification of attestation responses.