6 ms·
The page itself even mentions that it's an old exploit, it seems: > Plundervolt was first reported on June 7, 2019 by a group of international researchers: A
by girvo 4y ago
The page itself even mentions that it's an old exploit, it seems:
> Plundervolt was first reported on June 7, 2019 by a group of international researchers:
And that it appears to be fixed?
> If you do not use SGX, you do not need to do anything. If you do use SGX: Intel has released a microcode update that - together with a BIOS update - allows disabling of the undervolting interface. The fact that undervolting is disabled will be reflected in remote attestation. More information can be found in Intel's security advisory.
- curling_grad 4y agoThe title should be something like "Plundervolt (2019)".
- ungamed 4y agoTitle is fixed now, but it gave me a bit of a shock when I read this today.
- lrvick 4y agoAfter many side channel attacks on SGX Intel revealing fundamental design flaws, SGX is absent in recent Intel processors. Centralized services like Signal still pinky swear they will not use any of these exploits and break all the metadata promises they built on SGX. Even if the US government asks them nicely. Any security built on SGX is security theater.
- krastanov 4y agoI always assumed that SGX's use by Signal is just "cute" and "nice to have" and "defense in depth", not anything on which the security of my communication actually depends. Am I mistaken?
- anonymousDan 4y agoYou misrepresent. SGX is still very much alive on datacenter CPUs (with secure cloud computing the main application area).
- lrvick 4y agoTIL they dropped it for everything but Xeon. More reasons to avoid Xeon :-P https://community.intel.com/t5/Blogs/Products-and-Solutions/Security/Rising-to-the-Challenge-Data-Security-with-Intel-Confidential/post/1353141 https://community.intel.com/t5/Blogs/Products-and-Solutions/...
- fomine3 4y agoWould you think same for Apple Secure Enclave or ARM TrustZone?
- frozenport 4y agoHow does SGX work on non-Intel Android?
- duskwuff 4y agoIt doesn't. Signal uses it on the server side.
- nyanpasu64 4y agoCan you use Plundervolt into tricking the CPU into self-reporting that undervolting is disabled?