4 ms·
Ah. Reading the actual abstract[1] makes clear this relies on TRESOR. TRESOR, in turn, relies on storing the key in _debug registers_[2]. I suppose the Hypervis
by groby_b 12y ago
Ah. Reading the actual abstract[1] makes clear this relies on TRESOR. TRESOR, in turn, relies on storing the key in _debug registers_[2]. I suppose the Hypervisor part of HARES is mostly to protect those registers.
Of course, reporting that would require actual research, as opposed to the breathless rehashing of wired. About 30 seconds of it, but clearly too much.
[1] http://opencfp.immunityinc.com/talks/64/ http://opencfp.immunityinc.com/talks/64/
[2] https://www.usenix.org/legacy/event/sec11/tech/full_papers/Muller.pdf https://www.usenix.org/legacy/event/sec11/tech/full_papers/M...
- sarciszewski 12y agoI knew from the headline that this was clickbait and nearly fell for it before reading your comment. Thanks for linking to the underlying research and summarizing it.
- toast0 12y agoDebug registers require ring 0, so tresor would be restricted to (most generously) applications with kernel help, right?
- Ded7xSEoPKYNsDd 12y agoYes. Causing a TLB-Split requires ring 0, too.
- belorn 12y agoBy occupying the x86 debug register with key data, what impact does it have on a computer? Are they completely optional to the normal everyday operation?
- MichaelGG 12y agoYou should read the TRESOR paper. It's amazingly well done and explains everything. They go on to try to attack it many ways and check its security. They then patched a hypervisor with TRESOR, so that you can run any OS but still benefit from it. Really neat work. GP, thanks for posting that link. Debug registers are used for debugging, to set hardware breakpoints. They aren't really needed, as most debuggers use software breakpoints anyways.
- rjaco31 12y agoIf you're not doing debugging with hardware breakpoints, they're not used.
- pron 12y agoSorry. Couldn't find the actual paper. Can you explain that TLB-split technique? EDIT: Nevermind. Got it: The idea is probably to make sure D-TLB is pointed at the encrypted code so that the decrypted code (switched to I-TLB after decryption) can't be read, only executed. * https://www.blackhat.com/docs/us-14/materials/us-14-Torrey-MoRE-Shadow-Walker-The-Progression-Of-TLB-Splitting-On-x86-WP.pdf https://www.blackhat.com/docs/us-14/materials/us-14-Torrey-M... * http://www.cse.iitd.ernet.in/~sbansal/csl865/readings/self-checking-code.pdf http://www.cse.iitd.ernet.in/~sbansal/csl865/readings/self-c...