Researchers Use Intel SGX To Put Malware Beyond the Reach of Antivirus Software (arstechnica.com) 63
An anonymous reader shares an excerpt from an Ars Technica report: Researchers have found a way to run malicious code on systems with Intel processors in such a way that the malware can't be analyzed or identified by antivirus software, using the processor's own features to protect the bad code. As well as making malware in general harder to examine, bad actors could use this protection to, for example, write ransomware applications that never disclose their encryption keys in readable memory, making it substantially harder to recover from attacks. The research, performed at Graz University of Technology by Michael Schwarz, Samuel Weiser, and Daniel Gruss (one of the researchers behind last year's Spectre attack), uses a feature that Intel introduced with its Skylake processors called SGX ("Software Guard eXtensions"). SGX enables programs to carve out enclaves where both the code and the data the code works with are protected to ensure their confidentiality (nothing else on the system can spy on them) and integrity (any tampering with the code or data can be detected). The contents of an enclave are transparently encrypted every time they're written to RAM and decrypted upon being read. The processor governs access to the enclave memory: any attempt to access the enclave's memory from code outside the enclave is blocked; the decryption and encryption only occurs for the code within the enclave.
SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes. For example, an SGX enclave running on a cloud platform could be used to run custom proprietary algorithms, such that even the cloud provider cannot determine what the algorithms are doing. On a client computer, the SGX enclave could be used in a similar way to enforce DRM (digital rights management) restrictions; the decryption process and decryption keys that the DRM used could be held within the enclave, making them unreadable to the rest of the system. There are biometric products on the market that use SGX enclaves for processing the biometric data and securely storing it such that it can't be tampered with. SGX has been designed for this particular threat model: the enclave is trusted and contains something sensitive, but everything else (the application, the operating system, and even the hypervisor) is potentially hostile. While there have been attacks on this threat model (for example, improperly written SGX enclaves can be vulnerable to timing attacks or Meltdown-style attacks), it appears to be robust as long as certain best practices are followed.
SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes. For example, an SGX enclave running on a cloud platform could be used to run custom proprietary algorithms, such that even the cloud provider cannot determine what the algorithms are doing. On a client computer, the SGX enclave could be used in a similar way to enforce DRM (digital rights management) restrictions; the decryption process and decryption keys that the DRM used could be held within the enclave, making them unreadable to the rest of the system. There are biometric products on the market that use SGX enclaves for processing the biometric data and securely storing it such that it can't be tampered with. SGX has been designed for this particular threat model: the enclave is trusted and contains something sensitive, but everything else (the application, the operating system, and even the hypervisor) is potentially hostile. While there have been attacks on this threat model (for example, improperly written SGX enclaves can be vulnerable to timing attacks or Meltdown-style attacks), it appears to be robust as long as certain best practices are followed.
Starforce for the win (Score:5, Insightful)
DRM the gift that keeps on sucking dick.
sorry about the rough language but this is about all that DRM deserves.
Re: (Score:1)
Re: (Score:3)
Re:Starforce for the win (Score:4, Funny)
Johnny mnemonic called, and he knows kungfu
Re:Starforce for the win (Score:4, Funny)
Re: (Score:2)
"I knew you'd smell good."
When something happens to you that hasn't happened before, don't you at least have to install chrome
Re: (Score:3)
No, you get burning chrome.
Re: (Score:2)
Re: (Score:2)
Whoa!
Re:Starforce for the win (Score:4, Insightful)
Computing industry (Score:2)
Re:Computing industry (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
You know, if you track it all the way through, the Wizard of Oz has a surprise ending.
The Man Behind the Curtain [tvtropes.org]
Big Shadow, Little Creature [tvtropes.org]
Greedy people do shitty things behind closed doors. News at 11.
Re: (Score:2)
So the solution would be to remove those investors?
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
I was thinking of shooting them, but I like your idea better. Rope's cheaper than bullets and can be reused.
Re: (Score:2)
Works as designed (Score:3)
So a protected execution environment is protected from the rest of the system. Works as designed, then. That's the issue with anything (like weapons) - they don't differentiate whether they are used by "good" or "bad" guys (but for practical purposes "bad" guys get a lot more use out of them because they use these tools proactively, whereas "good" guys would only use them reactively).
Re: (Score:2)
"(the application, the operating system, and even the hypervisor) is potentially hostile" sounds like it was designed to be used for spyware. I guess it is working as advertised.
It's 2019, let me respond with a meme (Score:5, Funny)
Intel: Let's develop an architecture where an application can run with full protection from anything else running on the system.
Malware authors: *writes malware to run on architecture*
Intel: surprisedpikachu.png
Opaque Glass House? (Score:1)
One rock can shatter it but you don't get the benefit of looking in.
Re: (Score:2)
Pretty good analogy, actually.
Re: (Score:1)
Too true, too true.
Re: (Score:2)
When you're analyzing what malware does, you want to run malware. Preferably in a lab condition where you can watch and analyze what it does. So you can then create a malware scanner that finds and neutralizes the threat.
I wonder if you could use this (Score:4, Funny)
to mine bitcoins on other peoples computers.
Re: (Score:2)
to mine bitcoins on other peoples computers.
Shhhhhhhhh.
Old news, newly discovered (Score:5, Interesting)
Doing a search on how to disable SGX, I found an article on how this can be used to write secure botnets... dated 2014. It's taken this long to publicly announce that this is a "bad thing"?
Re: (Score:2)
This thing is closer to a gun than a knife, though. A gun only has one function, it shoots bullets with the intent to hit something. This isn't something you "have to" have to survive. You can pretty much go through your life without ever touching a gun, let alone firing it.
A knife, on the other hand, is something that you almost have to use. There are certain things in everyday (civilized) life that you can only do sensibly with a knife.
This is quite similar. You can go through your computer life without e
Too bad the headline isn't reversed (Score:2, Insightful)
Is this a Windows only vulnerability, or...? (Score:2)
Re: (Score:2)
It's in the chip so.. every intel-based system is vulnerable. Just a question of how easy through os makes it to abuse those powers.. and pretty much all os' will make it easy (at least for admin/root/whatever) because that's the entire function -- you can't enable "good" uses without also enabling "bad" uses.
Of course that only becomes relevant once average consumers care about "good" usages (playing movies or games or whatever drm crap it's actually a designed for.) Prior to that happening, consumer-foc
Wonderful (Score:2)
"Researchers have found a way to run malicious code on systems with Intel processors in such a way that the malware can't be analyzed or identified by antivirus software, using the processor's own features to protect the bad code"
Well now we're fucked.
Features that make developers smile (Score:2)
I feel nostalgic... (Score:1)
I feel nostalgic for the times when customer backlash forced Intel to withdraw the "Processor Serial Number" misfeature from their new Pentium III CPUs. And this was back when the x86 architecture was the undisputed king, not on the path to irrelevance like it's now.