Slashdot Mirror
Researchers Use Intel SGX To Put Malware Beyond the Reach of Antivirus Software (arstechnica.com)
An anonymous reader shares an excerpt from an Ars Technica report: Researchers have found a way to run malicious code on systems with Intel processors in such a way that the malware can't be analyzed or identified by antivirus software, using the processor's own features to protect the bad code. As well as making malware in general harder to examine, bad actors could use this protection to, for example, write ransomware applications that never disclose their encryption keys in readable memory, making it substantially harder to recover from attacks. The research, performed at Graz University of Technology by Michael Schwarz, Samuel Weiser, and Daniel Gruss (one of the researchers behind last year's Spectre attack), uses a feature that Intel introduced with its Skylake processors called SGX ("Software Guard eXtensions"). SGX enables programs to carve out enclaves where both the code and the data the code works with are protected to ensure their confidentiality (nothing else on the system can spy on them) and integrity (any tampering with the code or data can be detected). The contents of an enclave are transparently encrypted every time they're written to RAM and decrypted upon being read. The processor governs access to the enclave memory: any attempt to access the enclave's memory from code outside the enclave is blocked; the decryption and encryption only occurs for the code within the enclave.
SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes. For example, an SGX enclave running on a cloud platform could be used to run custom proprietary algorithms, such that even the cloud provider cannot determine what the algorithms are doing. On a client computer, the SGX enclave could be used in a similar way to enforce DRM (digital rights management) restrictions; the decryption process and decryption keys that the DRM used could be held within the enclave, making them unreadable to the rest of the system. There are biometric products on the market that use SGX enclaves for processing the biometric data and securely storing it such that it can't be tampered with. SGX has been designed for this particular threat model: the enclave is trusted and contains something sensitive, but everything else (the application, the operating system, and even the hypervisor) is potentially hostile. While there have been attacks on this threat model (for example, improperly written SGX enclaves can be vulnerable to timing attacks or Meltdown-style attacks), it appears to be robust as long as certain best practices are followed.
SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes. For example, an SGX enclave running on a cloud platform could be used to run custom proprietary algorithms, such that even the cloud provider cannot determine what the algorithms are doing. On a client computer, the SGX enclave could be used in a similar way to enforce DRM (digital rights management) restrictions; the decryption process and decryption keys that the DRM used could be held within the enclave, making them unreadable to the rest of the system. There are biometric products on the market that use SGX enclaves for processing the biometric data and securely storing it such that it can't be tampered with. SGX has been designed for this particular threat model: the enclave is trusted and contains something sensitive, but everything else (the application, the operating system, and even the hypervisor) is potentially hostile. While there have been attacks on this threat model (for example, improperly written SGX enclaves can be vulnerable to timing attacks or Meltdown-style attacks), it appears to be robust as long as certain best practices are followed.
DRM the gift that keeps on sucking dick.
sorry about the rough language but this is about all that DRM deserves.
The computing industry has gone downhill fast. It had a promising start with open systems and software, but now everything is about proprietary crap and hiding what the computer is doing.
So a protected execution environment is protected from the rest of the system. Works as designed, then. That's the issue with anything (like weapons) - they don't differentiate whether they are used by "good" or "bad" guys (but for practical purposes "bad" guys get a lot more use out of them because they use these tools proactively, whereas "good" guys would only use them reactively).
Intel: Let's develop an architecture where an application can run with full protection from anything else running on the system.
Malware authors: *writes malware to run on architecture*
Intel: surprisedpikachu.png
One rock can shatter it but you don't get the benefit of looking in.
to mine bitcoins on other peoples computers.
Doing a search on how to disable SGX, I found an article on how this can be used to write secure botnets... dated 2014. It's taken this long to publicly announce that this is a "bad thing"?
Too true, too true.
"Researchers Use Intel SGX To Put Malware Beyond the Reach of Antivirus Software" actually sounds pretty cool from a technical point of view. Terrifying, but also cool. It would have been way cooler if the headline was "Researchers use Intel SGX to Put Operating Systems and their Associated Software Beyond the Reach of Malware" or even better, "Operating System Vendors use Intel SGX to Protect their Users from Malware"
Is this pretty much an every OS issue like Spectre/Meltdown?
"Researchers have found a way to run malicious code on systems with Intel processors in such a way that the malware can't be analyzed or identified by antivirus software, using the processor's own features to protect the bad code"
Well now we're fucked.
Just cruising through this digital world at 33 1/3 rpm...
I clearly recall Internet Explorer being announced with "Features that make developers smile". I think this was IE6 And yes, it made all hackers laugh out loud. It made developers cry off course about the new load of attack vectors. "SGX has been promoted as a solution to a range of security concerns when a developer wants to protect code, data, or both, from prying eyes." It does not take more than two seconds to realize that this "feature" is far more beneficial to malware than to user-approved software. Intel is the new Microsoft. IE6 seems to have become a feature of the processor.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
When you're analyzing what malware does, you want to run malware. Preferably in a lab condition where you can watch and analyze what it does. So you can then create a malware scanner that finds and neutralizes the threat.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This thing is closer to a gun than a knife, though. A gun only has one function, it shoots bullets with the intent to hit something. This isn't something you "have to" have to survive. You can pretty much go through your life without ever touching a gun, let alone firing it.
A knife, on the other hand, is something that you almost have to use. There are certain things in everyday (civilized) life that you can only do sensibly with a knife.
This is quite similar. You can go through your computer life without ever needing this. Obviously, since it didn't even exist until a couple years ago.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I feel nostalgic for the times when customer backlash forced Intel to withdraw the "Processor Serial Number" misfeature from their new Pentium III CPUs. And this was back when the x86 architecture was the undisputed king, not on the path to irrelevance like it's now.