5 ms·
New attacks are diluting secure enclave defenses from Nvidia, AMD, and Intel
- 7e 1y ago"All three chipmakers exclude physical attacks from threat models for their TEEs." So, working as intended.
- general1465 1y agoI would think that having TEE means that you can run secure software on unsecured hardware, if that's not the case, then what's the point of TEE in the first place?
- saurik 1y agoIf I have my hardware under lock and key in my house, this lets me only trust the CPU vendor and not the software stack running on my computer when I try to verify that it is running exactly the workload that I intended. With a third party, if I trust you to not tamper with your hardware, this let's both of us remove the people who wrote the hypervisor from our trust base.
- ForHackernews 1y agoA wise elder once told me, "There are no secrets in silicon." (e.g. https://www.sciencedirect.com/science/article/abs/pii/S0026271425001106 https://www.sciencedirect.com/science/article/abs/pii/S00262...) If an attacker with time and resources has physical access, you are doomed.
- immibis 1y agoIt works in practice because most don't have enough time, physical access, and electron microscopes.
- beeflet 1y agoI think it provides a false sense of security in practice. You end up relying on security methods that dont work against adversaries above a level of initial investment.
- i80and 1y agoIt is also true that making attackers spend time and resources has value. Just because you're trapped in a Red Queen race doesn't mean you should stop running
- PaulHoule 1y agoBut way too often getting into the TPM on one machine leaks secrets that enable a global compromise. In the case of media piracy, for instance, DRM might inconvenience millions of people but it takes just one person to crack it, either head on or through the analog hole and then the files are on BitTorrent.
- immibis 1y agoGood. I like the idea of a secure enclave that I own and control when it's in my computer but in practice almost all of them are deployed in a user-hostile way to the benefit of shareholders, to the point that burning the whole idea down would improve society. Imagine if every ROM and piece of CPU microcode was a lot more transparent. These things are often used because of contractual requirements. Mainstream media including video games are often contractually protected: you must not let it run/play on any device without sufficient hardware protections. So vendors have to include these protection systems even if they don't want to. If the systems were useless, this might end.
- luma 1y agoMore recently, TPM and the systems surrounding it are being effectively used for attestation of the entire OS and driver stack at boot time, from UEFI up to a running OS. DRM sucks, but I do appreciate having some degree of hardware-level defense against rootkits or other advanced malware.
- PaulHoule 1y agoPractically though those systems seem to be pretty weak and are always getting broken, the TPM itself is another place where malware can hide, it's not clear to me that the benefits could ever outweigh the risks.
- AstralStorm 1y agoTPM itself is a simple data container with slow encryption/decryption capabilities. It cannot hide anything really. You might have mistaken it for say Intel ME and the AMD equivalent.
- Whinner 1y agoFrom the article, "The low-cost, low-complexity attack works by placing a small piece of hardware between a single physical memory chip and the motherboard slot it plugs into. It also requires the attacker to compromise the operating system kernel". "Low-complexity" requires physical access and an OS compromise? What the hell would high complexity be?
- jcranmer 1y agoAnd the images also show that "small piece of hardware" is connected to lots of chonky ribbon connectors that make IDE cables look slim.
- SAI_Peregrinus 1y agoFocused Ion Beam workstation, decap the relevant IC & probe its internal connections directly. If protected by a mesh, also use the FIB to deposit extra metal to bypass the mesh to make the probe holes. If protected by light sensors, also bypass them. Create glitches by shining highly focused lasers onto specific transistors at specific times. Etc. The sorts of attacks Christopher Tarnovsky did on a bunch of TPMs & talked about at DEFCON.
- beeflet 1y agoI was looking for the old CCC talk about this stuff, but I ended up finding out about a project called RayV Lite which seeks to democratize this hardware https://www.netspi.com/blog/executive-blog/hardware-and-embedded-systems-penetration-testing/how-rayv-lite-is-democratizing-laser-fault-injection/ https://www.netspi.com/blog/executive-blog/hardware-and-embe... https://github.com/ProjectLOREM/RayVLite https://github.com/ProjectLOREM/RayVLite
- thenthenthen 1y agoCould not find the CCC talk but here is a netspi presentation at this years BlackHat: https://youtu.be/Wyv3pSQopp0?si=dyVaYYlwkkXkkO8r https://youtu.be/Wyv3pSQopp0?si=dyVaYYlwkkXkkO8r
- codedokode 1y agoAs I understand, the purpose of "secure enclaves" is to enforce DRM, copyright protection, anti-debugging measures, so breaking them is a good thing.
- embedding-shape 1y agoWell, also used for confidential computing and other stuff that you might benefit from too, so not just to gatekeep stuff. Depending on what you use it for (or rather, what your computer is using it for), you might not want it broken in all cases. With that said, I'd rather see it broken than not, considering it's mostly used for negative stuff, and it isn't open enough to evaluate if it actually is secure enough.
- codedokode 1y agoThe purpose of secure enclave is to prevent administrator from accessing the data. I don't want anyone doing "confidential computing" on my devices. I am the person which can be trusted so there is no need to hide the encryption keys from me.
- hollerith 1y agoThe false assumption in your argument IMHO is the assumption that none of the software on your device will ever betray you or contain an exploitable security hole. In actuality, it is useful from time to time to be able to run software you cannot completely trust such that the software cannot access all the data on the device (because the untrusted software cannot access your enclave).
- ndriscoll 1y agoThat's why you run that software as its own untrusted user and perhaps run it with some kind of sandbox. It's not a reason for you the owner to not have root access at all.
- 1y ago
- rhodey 1y agoAmazon Nitro Enclaves not effected IMO Amazon is the obvious choice for TEE because they make billions selling isolated compute If you built a product on Intel or AMD and need to pivot do take a look at AWS Nitro Enclaves I built up a small stack for Nitro: https://lock.host/ https://lock.host/ has all the links MIT everything, dev-first focus AWS will tell you to use AWS KMS to manage enclave keys AWS KMS is ok if you are ok with AWS root account being able to get to keys If you want to lock your TEE keys so even root cannot access I have something i the works for this Write to: hello@lock.host if you want to discuss
- beeflet 1y agowhy wouldn't it be effected?
- rhodey 1y agoBecause AWS does not sell the Nitro TEE hardware And so there is no case where you find a Nitro TEE online and the owner is not AWS And it is practically impossible to break into AWS and perform this attack The trust model of TEE is always: you trust the manufacturer Intel and AMD broke this because now they say: you also trust where the TEE is installed AWS = you trust the manufacturer = full story
- 7e 1y agoNitro Enclaves also require you to trust Amazon. No thanks, I'll take the hardware based solution.