When Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins

on YouTube ↗54m

" summary

Demonstrates that malware inside Intel SGX can stealthily exfiltrate keys by running an attacker enclave that builds an SGX-resident key extractor and uses Prime+Probe and Flush+Reload to observe secret-dependent memory accesses; reconstructs a 4096-bit RSA private key from a co-located enclave in practical runs and hides activity from OS-level detectors by running entirely in enclave context; also shows a cache-triggered race exploit that defeats DRM-like double-fetch checks and a TSX-based mitigation.

AI-written summary · about

" chapters (11)

1. 0:00Introduction to SGX attacks
2. 3:33How Intel SGX works
3. 6:55Side-channel attack concepts
4. 11:45Attacking SGX enclaves
5. 15:46Extracting private keys
6. 20:59Countermeasures and defenses
7. 25:02Exploiting DRM systems
8. 30:28Detecting double fetches
9. 34:05Exploiting double fetches
10. 40:01Preventing double-fetch bugs
11. 48:18Key takeaways and Q&A

" related talks

• 25mForeshadow: Extracting the Keys to the Intel SGX Kingdom...Jo Van Bulck · USENIX Security '18
• 25mTelling Your Secrets without Page Faults...Raoul Strackx, Frank Piessens, Jo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza · 26th USENIX Security Symposium (USENIX Security '17)
• 33mHacking in Darkness: Return-oriented Programming against Secure EnclavesYeongjin Jang, Taesoo Kim, Jaehyuk Lee, Jinsoo Jang, Nohyun Kwak, Yeseul Choi, Changho Choi, Marcus Peinado, Brent Byunghoon Kang · 26th USENIX Security Symposium (USENIX Security '17)
• 23mThe Guard's Dilemma: Efficient Code-Reuse Attacks Against Intel SGXAndrea Biondo · USENIX Security '18
• 48mSGX Secure Enclaves in Practice: Security and Crypto ReviewJean-Philippe Aumasson, Luis Merino · Black Hat USA 2016
• 49mBreaking Hardware-Enforced Security With HypervisorsJoseph Sharkey · Black Hat USA 2016
• 38mOne Ring -3 To Secure Them All: Computing with Hardware EnclavesAaron Bedra · Craft Conference 2021
• 47mHow to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management EngineMaxim Goryachy, Mark Ermolov · Black Hat Europe 2017