Slashdot Mirror
Researchers Use Intel SGX To Put Malware Beyond the Reach of Antivirus Software (arstechnica.com)
An anonymous reader shares an excerpt from an Ars Technica report: Researchers have found a way to run malicious code on systems with Intel processors in such a way that the malware can't be analyzed or identified by antivirus software, using the processor's own features to protect the bad code. As well as making malware in general harder to examine, bad actors could use this protection to, for example, write ransomware applications that never disclose their encryption keys in readable memory, making it substantially harder to recover from attacks. The research, performed at Graz University of Technology by Michael Schwarz, Samuel Weiser, and Daniel Gruss (one of the researchers behind last year's Spectre attack), uses a feature that Intel introduced with its Skylake processors called SGX ("Software Guard eXtensions"). SGX enables programs to carve out enclaves where both the code and the data the code works with are protected to ensure their confidentiality (nothing else on the system can spy on them) and integrity (any tampering with the code or data can be detected). The contents of an enclave are transparently encrypted every time they're written to RAM and decrypted upon being read. The processor governs access to the enclave memory: any attempt to access the enclave's memory from code outside the enclave is blocked; the decryption and encryption only occurs for the code within the enclave.
SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes. For example, an SGX enclave running on a cloud platform could be used to run custom proprietary algorithms, such that even the cloud provider cannot determine what the algorithms are doing. On a client computer, the SGX enclave could be used in a similar way to enforce DRM (digital rights management) restrictions; the decryption process and decryption keys that the DRM used could be held within the enclave, making them unreadable to the rest of the system. There are biometric products on the market that use SGX enclaves for processing the biometric data and securely storing it such that it can't be tampered with. SGX has been designed for this particular threat model: the enclave is trusted and contains something sensitive, but everything else (the application, the operating system, and even the hypervisor) is potentially hostile. While there have been attacks on this threat model (for example, improperly written SGX enclaves can be vulnerable to timing attacks or Meltdown-style attacks), it appears to be robust as long as certain best practices are followed.
SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes. For example, an SGX enclave running on a cloud platform could be used to run custom proprietary algorithms, such that even the cloud provider cannot determine what the algorithms are doing. On a client computer, the SGX enclave could be used in a similar way to enforce DRM (digital rights management) restrictions; the decryption process and decryption keys that the DRM used could be held within the enclave, making them unreadable to the rest of the system. There are biometric products on the market that use SGX enclaves for processing the biometric data and securely storing it such that it can't be tampered with. SGX has been designed for this particular threat model: the enclave is trusted and contains something sensitive, but everything else (the application, the operating system, and even the hypervisor) is potentially hostile. While there have been attacks on this threat model (for example, improperly written SGX enclaves can be vulnerable to timing attacks or Meltdown-style attacks), it appears to be robust as long as certain best practices are followed.
DRM the gift that keeps on sucking dick.
sorry about the rough language but this is about all that DRM deserves.
The computing industry has gone downhill fast. It had a promising start with open systems and software, but now everything is about proprietary crap and hiding what the computer is doing.
So a protected execution environment is protected from the rest of the system. Works as designed, then. That's the issue with anything (like weapons) - they don't differentiate whether they are used by "good" or "bad" guys (but for practical purposes "bad" guys get a lot more use out of them because they use these tools proactively, whereas "good" guys would only use them reactively).
Intel: Let's develop an architecture where an application can run with full protection from anything else running on the system.
Malware authors: *writes malware to run on architecture*
Intel: surprisedpikachu.png
One rock can shatter it but you don't get the benefit of looking in.
And major security problems that are very real.
This is why Gordon Moore got out. Too many sleazy managers out for themselves, lying their way through the hierarchy, contaminating the engineering process with incompetent political drones that keep coming up with crap ideas that they support with lies and marketing dollars.
If people insist on running malware like this, can't they just run it in OpenSGX emulation, under QEMU? That ought to keep the actual memory used from being unreadable.
Of course, it raises the whole damn question of why someone would be running malware and a malware scanner. It seems like if you want one, you wouldn't want the other.
to mine bitcoins on other peoples computers.
Doing a search on how to disable SGX, I found an article on how this can be used to write secure botnets... dated 2014. It's taken this long to publicly announce that this is a "bad thing"?
"What will you, an average person, do?"
Guess I'll stab someone because knives can cut, right?
Sadly almost anything that is particularly useful can be abused the hardest.
Again, if we liken it to guns vs knives, far easier to control the flow of guns, but how the fuck are you going to control knives? You literally can't. It's a foundation to modern society.
Good security is a similar problem. If you get so advanced with your security, bad actors can also abuse the absolute hell out of it.
The only solution I can see, at a rough guess, is trusted security keys given to security companies, which itself open a gaping security hole to the system and basically kills off any smaller security companies usefulness since any random bad actor could use dirty money to make some start-up, beg for access, system broke.
Then you would need some method to revoke keys, but if a system is already screwed, they could just update the firmware and block your update mechanism. Firmwares can and do lie.
There's no easy solution to this, because, as always, the computing industry thinks it is a better idea to revoke control from the users of devices via hidden hardware and software interfaces.
I picture them researching this like it was a great unsolved problem of science. "How can we Fuck Up Everything, Forever?".
Thanks Intel, you've finally made the world safer for pay-per-view video streams. God forbid you collect money only once. The security of your rent model will live on, even if nobody feels comfortable sitting in front of your computers ever again. This is real progress. Brilliant, essential technology.
I guess APK has psychic precognitive powers so his blacklist will always 100% cover every possible site that may host malware. Amazing! He should seriously be on TV. He should also claim that $1 million award for proof of ESP. In fact I bet he already knew I was going to post this!
"Researchers Use Intel SGX To Put Malware Beyond the Reach of Antivirus Software" actually sounds pretty cool from a technical point of view. Terrifying, but also cool. It would have been way cooler if the headline was "Researchers use Intel SGX to Put Operating Systems and their Associated Software Beyond the Reach of Malware" or even better, "Operating System Vendors use Intel SGX to Protect their Users from Malware"
See subject: Via APK Hosts File Engine 2.0++ 64-bit for Linux/BSD h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p
Yields more security/speed/reliability/anonymity vs. any 1 solution (99% of threats use hostnames vs. IP address most firewalls use) more efficiently/FASTER + NATIVELY 4 less.
Vs. "Bolt on 'MoAr' illogic-logic" slowing u hosts speed u up 2 ways: Adblocks + Hardcode fav. sites u spend most time @ vs. competition w/ security bugs (DNS/AntiVir) + overheads slowing u (messagepass 'souled-out' to advertisers easily detected & blocked addons + firewall filtering drivers) & their complexity leads to exploit!
* ONLY 1 of its kind in GUI 4 Linux (soon 4 MacOS).
APK
P.S.=> Protects vs. scripts/trackers (kernelmode faster vs. usermode slower NoScript vs. 3rd party script)/ads/DNS request tracking + redirect poisoned or downed DNS/botnets/malware download/malcript/email malicious payload
No one wants to hear your bullshit. If they did they would have said "APK can you come and smear some of your host file bullshit all over the page". Since this didn't happen you can be assured that no one wants to hear from you. You add nothing to this discussion.
Is this pretty much an every OS issue like Spectre/Meltdown?
"Researchers have found a way to run malicious code on systems with Intel processors in such a way that the malware can't be analyzed or identified by antivirus software, using the processor's own features to protect the bad code"
Well now we're fucked.
Just cruising through this digital world at 33 1/3 rpm...
Vs. "Bolt on 'MoAr' illogic-logic" slowing u hosts speed u up 2 ways: Adblocks + Hardcode fav. sites u spend most time @ vs. competition w/ security bugs (DNS/AntiVir) + overheads slowing u (messagepass 'souled-out' to advertisers easily detected & blocked addons + firewall filtering drivers) & their complexity leads to exploit!
You do realize that this is gibberish, right?
I mean really- just try and read it and you'll see it's pure word salad.
Even if what you're so desperately trying to say is true, it's an indecipherable word-stream that looks like it was written by a tweaker. Why would I ever consider buying or using a product that looks like the description was taken straight out of a bad Scrabble game?
Sounds like you don't want anyone hearing truth apk put out based on YOUR bullshit.
It's not anyone's fault you can't read but your own you illiterate troll.
See subject & results in https://tech.slashdot.org/comm... https://yro.slashdot.org/comme... https://it.slashdot.org/commen... https://linux.slashdot.org/com... https://news.slashdot.org/comm... https://apple.slashdot.org/com... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://search.slashdot.org/co... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://tech.slashdot.org/comm... https://tech.slashdot.org/comm... https://apple.slashdot.org/com... https://tech.slashdot.org/comm... https://it.slashdot.org/commen... https://tech.slashdot.org/comm... https://tech.slashdot.org/comm... https://science.slashdot.org/c...
* That's only recently while I've been on Linux (July 2018) & 100's of times vs. MANY other botnets/malwares etc. in the past circa 2006-early 2018 while I was on Windows: CONCRETE VERIFIABLE UNDENIABLE REALITY (see those links as proof). ... & that's ONLY what /. reported on (there were FAR more)
APK
P.S.=> "It's working: Neville... it's working!" - "I AM LEGEND" + HOSTNAME USE IS DOWN IN MALWARE https://unit42.paloaltonetwork... (my ACT OF FAITH is JUSTIFIED by fact)... apk
Really fucking helpful research there guys.
I'd call this more like weapons development and then advertising for a buyer.
Research. Riiigghhht.
As you may have read correctly, this is a hardware feature. And unless you use a custom-etched ROM chip for your OS, that means it's OS independent. :)
I clearly recall Internet Explorer being announced with "Features that make developers smile". I think this was IE6 And yes, it made all hackers laugh out loud. It made developers cry off course about the new load of attack vectors. "SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes." It does not take more than two seconds to realize that this "feature" is far more beneficial to malware than to user-approved software. Intel is the new Microsoft. IE6 seems to have become a feature of the processor.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
When you're analyzing what malware does, you want to run malware. Preferably in a lab condition where you can watch and analyze what it does. So you can then create a malware scanner that finds and neutralizes the threat.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Now all we need is a way to run _all_ of our own software in the same sort of isolated environment, so that the malware can't find out what _we_ are doing!
Oh, wait a minute...
"Found a way"? I think it is more like it is being used as advertised? Only it is of bad intention. Duh not a research !
There are still real herbal doctors out there, despite the fact that there are lot of scammers out there that claim to be doctors, I got my penis enlarged with the help of Dr. Okpoko, and he also provided remedy for me which cured me from premature ejaculation and erectile dysfunction, I haven't been able to satisfy my wife since I got married, until I decided to check online on the internet if I could get help to my problem, so luckily I met his email address on one of the site I checked, I saw where his email was posted with a testimonial of how he help cured a guy from erectile dysfunction, so I decided to contact him and explain to him my own present predicament, and he promised to help me out, I thought he was trying to take advantage of me and just get my money because I have lost a lot of money in the past trying to get over this problem, but to my greatest surprise, he actually provided a solution for me as we agreed, after he received money from me to get the items he used in preparing the remedy he sent to me,
if there is anyone here that need remedy to erectile dysfunction, premature ejaculatuion or anyone that need penis enlargement, kindly contact him on his email address and be a happy man and make your wife or girl friend happy as well
his email address is
adamokpoko@gmail.com or whatsApp him on +2348151731392
he also has cure to various diseases such as cancer, herpes, leukemia, kidney problems, diabetes and lots more,
THANK YOU FOR READING
I feel nostalgic for the times when customer backlash forced Intel to withdraw the "Processor Serial Number" misfeature from their new Pentium III CPUs. And this was back when the x86 architecture was the undisputed king, not on the path to irrelevance like it's now.