Security News > 2020 > November > Stick a fork in SGX, it's done: Intel's cloud-server security defeated by $30 chip and electrical shenanigans
![Stick a fork in SGX, it's done: Intel's cloud-server security defeated by $30 chip and electrical shenanigans](/static/build/img/news/alt/antivirus-stats-medium.jpg)
Plundervolt is a software-based attack on recent Intel processors running SGX enclaves that lowers the voltage to induce faults or errors that allow the recovery of secrets like encryption keys.
Half the point of SGX is to protect sensitive code and data from rogue server administrators when said servers are out of reach and in someone else's data center - such as a cloud provider's - and yet it is possible for someone at a cloud provider with physical access to a box to jolt an Intel processor into breaking its SGX protections.
"This attack is quite relevant because it is often claimed that SGX can defend against malicious insiders/cloud providers," said David Oswald, a lecturer in the security and privacy group at the University of Birmingham, and one of the paper's co-authors, in an email to The Register.
Oswald pointed to what Intel says about Microsoft Azure DCsv2-series virtual machines running on Intel Xeon E processors with SGX: "Even cloud administrators and datacenter operators with physical access to the servers cannot access the Intel SGX-protected data."
The researchers disclosed the attack to Intel in March, and were told that "Opening the case and tampering of internal hardware to compromise SGX is out of scope for SGX threat model. Patches for CVE-2019-11157 were not designed to protect against hardware-based attacks as per the threat model." So there goes that whole promise for Microsoft Azure, then.
News URL
https://go.theregister.com/feed/www.theregister.com/2020/11/14/intel_sgx_protection_broken/
Related news
- 7 Best Cloud Security Posture Management (CSPM) Tools for 2024 (source)
- Cloud security incidents make organizations turn to AI-powered prevention (source)
- eBook: 10 reasons why demand for cloud security is sky-high (source)
- Managing Cloud Security Posture: Continuous Monitoring and Hardening for Visibility and Compliance (source)
- VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi (source)
- Phoenix UEFI flaw puts long list of Intel chips in hot seat (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2019-12-16 | CVE-2019-11157 | Unspecified vulnerability in Intel products Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access. | 6.7 |