3 ms·
Intel could presumably help the ransomware authors bypass SGX protections but that’d be dumb. They might have some capability to trace attestations to a specifi
by matthewdgreen 3y ago
Intel could presumably help the ransomware authors bypass SGX protections but that’d be dumb. They might have some capability to trace attestations to a specific motherboard but I doubt any sophisticated ransomware group will be foiled by this.
- crotchfire 3y agoI was implying that Intel would help the victims. Attestations are quite certainly traceable to the EPID, which is a fuse array -- it's on the die, not the motherboard. In order to attest, the key that encrypts the victim's data would have to be SGX-generated. What kind of RNG do you think it uses? Maybe Dual_EC_DRDBG?
- Dylan16807 3y agoHelp the victims how? If the CPUs have been captured, there's no need for altered firmware. If the CPUs have not been captured, then how is the altered firmware going to get installed? I suppose it helps them in the former case, if they also had no backups. But the hackers are already in a very bad place if the CPUs get captured, so I don't think they care about SGX at that point. The hackers don't need to trust SGX. They only need the victims to trust it.