6 ms·

V0LTpwn: Attacking x86 Processor Integrity from Software

102 points by gandalfgeek 7y ago

grifball 7y ago
>the only software-based fault exploit Plundervolt came out around the same time and is similar, the authors may not have known about each other.
- crypt0x 7y ago
  Also came here wondering how it relates to this. https://plundervolt.com/ https://plundervolt.com/ https://media.ccc.de/v/36c3-10883-plundervolt_flipping_bits_from_software_without_rowhammer https://media.ccc.de/v/36c3-10883-plundervolt_flipping_bits_...
  - grifball 7y ago
    I only read a little bit of voltpwn, but plundervolt is really cool. In one of the attacks, a fault is caused in the RSA scheme initialization, leading to reduced strength that can be broken. I guess a similar attack is possible with AES, but i dont understand it as well.
loser777 7y ago
I might be misreading the paper, but it seems like that this is due to an unfaithful implementation of the hardware that allows for undervolting occur with the right mix of instructions, P-states, and software, rather than a fundamental design flaw? Basically the equivalent of shipping a chip with the operating voltage set too aggressively so that the right sequence of instructions trips it up.
mehrdadn 7y ago
I feel dumb for asking this, but is this really something that's not supposed to be possible from software? My assumption was always that if you overlock, undervolt, etc. then (a) you already have high-privileged code running, and (b) anything can go wrong from crashes to physically breaking your CPU, so I'm not really shocked (not sure if pun intended) to hear undervolting can damage the software state. Should I be?
- saagarjha 7y ago
  > you already have high-privileged code running I just glanced at the abstract, but they seem to be attacking the SGX enclave, which is supposed to be isolated even from privileged code.
  - userbinator 7y ago
    ...in other words, they attacked the horribly user-hostile anti-feature whose real practical purpose is DRM, and so I certainly think nothing of value was lost. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
    - saagarjha 7y ago
      There’s been a couple of non-DRM uses of SGX, which I’m sure you’ve seen. And regardless of what it’s being used for, I think you know it’d be more productive to talk about the attack rather than potential uses of what they’re attacking.
    - baby 7y ago
      Is SGX actually used by DRMs? I read that TPMs were designed for DRMs as well and ended up being used for whole different purposes (secure boot, disk encryption)
      - dnautics 7y ago
        I read somewhere that Netflix drm runs in sgx and they're basically the only ones.
        tedunangst 7y ago
        I read that Netflix doesn't use SGX.
    - achamayou 7y ago
      There are many interesting uses for enclaves, most of which have nothing to do with DRM. A good example is Signal’s secure value recovery mechanism: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
sqldba 7y ago
It seems it requires root privileges to start with. Am I misunderstanding?
- baq 7y ago
  SGX is supposed to be able to hide stuff from root.
- exikyut 7y ago
  Extending the other answer, root on eg a hypervisor guest also shouldn't give you access to secrets hidden from even the bare-metal root account.
nneonneo 7y ago
Intel SGX is really a big gift to security researchers, second only to speculative execution and friends. Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. SGX has opened Intel up to physical attacks on the chip in a way that really hasn’t been interesting in the past. Previously attacking a CPU physically wouldn’t give you any more capabilities than you already had (with unlimited ability to tamper I/O and memory). Now, physically attacking the CPU can be used to reveal SGX secrets or mess with SGX computations. Expect a lot more attacks like this to come out in the future!
- bluegreyred 7y ago
  > Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. As a layman I have to wonder, should we expect similar attacks on Apple's Secure Enclave in the future?
  - Twisell 7y ago
    Interesting question would love to read some insights about that too. From my really basic understanding Apple Secure Enclave is a co-processor so other rules should apply but I'm also a poor layman in hardware design.
  - kohtatsu 7y ago
    Apple's Secure Enclave is a coprocessor designed specifically to reduce attack surface, and minimize the surface area of untrusted code. It physically separates the ephemeral secret-storing (touch/face ID) and the hardcoded crypto keys (not even the SE firmware has access to the key material, it's just allowed to run the circuits). Check out the iOS Security Guide whitepaper.
  - deleted 7y ago
    [deleted]
non-entity 7y ago
How do security researches manage to find stuff like this? o they just run some sort of fuzzer until something interesting happens and they try to reproduce it? Do they scan intel manuals from top to bottom and are intelligent enough to read vulnerabilities through the lines? I am incredibly fascinated by this stuff, but reading things like: > The hardware interfaces to adjust the voltage (Section 2.2) are undocumented. To use them, we had to rely on third-party reverse-engineered partial documentation and piece it together to develop a real-world setup running on our systems, which required substantial effort on our part. Is so strange to me. I have no idea how people manage to, or even decide to take on tasks like that. I have trouble finding that sort of stuff even when I know exactly what I'm looking for.
- saagarjha 7y ago
  Usually they read a lot, have a general idea of how things might be organized and where vulnerabilities might lie, and then they try a bunch of things to see what works.
  - baby 7y ago
    This. After having read a lot of papers you can find out how you can use that knowledge to produce another one.
    - non-entity 7y ago
      Is there a good site or journal that specializes in these things, other than occasionally getting aggregated to HN or Reddit. I'm always intrigued by processor level exploits, especially more obscure ones like this.
      - baby 7y ago
        For having spent the last month reading about it: 1. google keywords like smart card, tpm, hsm, secure element, tee, sgx, secure enclave, trustzone, etc. 2. then add the keywords attack, threat model, etc. 3. Read all the papers

102 points by gandalfgeek 7y ago

>the only software-based fault exploit Plundervolt came out around the same time and is similar, the authors may not have known about each other.

crypt0x 7y ago
Also came here wondering how it relates to this. https://plundervolt.com/ https://plundervolt.com/ https://media.ccc.de/v/36c3-10883-plundervolt_flipping_bits_from_software_without_rowhammer https://media.ccc.de/v/36c3-10883-plundervolt_flipping_bits_...
- grifball 7y ago
  I only read a little bit of voltpwn, but plundervolt is really cool. In one of the attacks, a fault is caused in the RSA scheme initialization, leading to reduced strength that can be broken. I guess a similar attack is possible with AES, but i dont understand it as well.

loser777 7y ago

I might be misreading the paper, but it seems like that this is due to an unfaithful implementation of the hardware that allows for undervolting occur with the right mix of instructions, P-states, and software, rather than a fundamental design flaw? Basically the equivalent of shipping a chip with the operating voltage set too aggressively so that the right sequence of instructions trips it up.

mehrdadn 7y ago

I feel dumb for asking this, but is this really something that's not supposed to be possible from software? My assumption was always that if you overlock, undervolt, etc. then (a) you already have high-privileged code running, and (b) anything can go wrong from crashes to physically breaking your CPU, so I'm not really shocked (not sure if pun intended) to hear undervolting can damage the software state. Should I be?

saagarjha 7y ago
> you already have high-privileged code running I just glanced at the abstract, but they seem to be attacking the SGX enclave, which is supposed to be isolated even from privileged code.
- userbinator 7y ago
  ...in other words, they attacked the horribly user-hostile anti-feature whose real practical purpose is DRM, and so I certainly think nothing of value was lost. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
  - saagarjha 7y ago
    There’s been a couple of non-DRM uses of SGX, which I’m sure you’ve seen. And regardless of what it’s being used for, I think you know it’d be more productive to talk about the attack rather than potential uses of what they’re attacking.
  - baby 7y ago
    Is SGX actually used by DRMs? I read that TPMs were designed for DRMs as well and ended up being used for whole different purposes (secure boot, disk encryption)
    - dnautics 7y ago
      I read somewhere that Netflix drm runs in sgx and they're basically the only ones.
      - tedunangst 7y ago
        I read that Netflix doesn't use SGX.
  - achamayou 7y ago
    There are many interesting uses for enclaves, most of which have nothing to do with DRM. A good example is Signal’s secure value recovery mechanism: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/

sqldba 7y ago

It seems it requires root privileges to start with. Am I misunderstanding?

baq 7y ago
SGX is supposed to be able to hide stuff from root.
exikyut 7y ago
Extending the other answer, root on eg a hypervisor guest also shouldn't give you access to secrets hidden from even the bare-metal root account.

nneonneo 7y ago

Intel SGX is really a big gift to security researchers, second only to speculative execution and friends. Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. SGX has opened Intel up to physical attacks on the chip in a way that really hasn’t been interesting in the past. Previously attacking a CPU physically wouldn’t give you any more capabilities than you already had (with unlimited ability to tamper I/O and memory). Now, physically attacking the CPU can be used to reveal SGX secrets or mess with SGX computations. Expect a lot more attacks like this to come out in the future!

bluegreyred 7y ago
> Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or even physical access. Of course, a bevy of attacks in the recent months have demonstrated that this isn’t really achievable given the extremely large attack surface. As a layman I have to wonder, should we expect similar attacks on Apple's Secure Enclave in the future?
- Twisell 7y ago
  Interesting question would love to read some insights about that too. From my really basic understanding Apple Secure Enclave is a co-processor so other rules should apply but I'm also a poor layman in hardware design.
- kohtatsu 7y ago
  Apple's Secure Enclave is a coprocessor designed specifically to reduce attack surface, and minimize the surface area of untrusted code. It physically separates the ephemeral secret-storing (touch/face ID) and the hardcoded crypto keys (not even the SE firmware has access to the key material, it's just allowed to run the circuits). Check out the iOS Security Guide whitepaper.
- deleted 7y ago
  [deleted]

non-entity 7y ago

How do security researches manage to find stuff like this? o they just run some sort of fuzzer until something interesting happens and they try to reproduce it? Do they scan intel manuals from top to bottom and are intelligent enough to read vulnerabilities through the lines? I am incredibly fascinated by this stuff, but reading things like: > The hardware interfaces to adjust the voltage (Section 2.2) are undocumented. To use them, we had to rely on third-party reverse-engineered partial documentation and piece it together to develop a real-world setup running on our systems, which required substantial effort on our part. Is so strange to me. I have no idea how people manage to, or even decide to take on tasks like that. I have trouble finding that sort of stuff even when I know exactly what I'm looking for.

saagarjha 7y ago
Usually they read a lot, have a general idea of how things might be organized and where vulnerabilities might lie, and then they try a bunch of things to see what works.
- baby 7y ago
  This. After having read a lot of papers you can find out how you can use that knowledge to produce another one.
  - non-entity 7y ago
    Is there a good site or journal that specializes in these things, other than occasionally getting aggregated to HN or Reddit. I'm always intrigued by processor level exploits, especially more obscure ones like this.
    - baby 7y ago
      For having spent the last month reading about it: 1. google keywords like smart card, tpm, hsm, secure element, tee, sgx, secure enclave, trustzone, etc. 2. then add the keywords attack, threat model, etc. 3. Read all the papers