Breaking Hardware-Enforced Security With Hypervisors
summary
Claim: a thin hypervisor rootkit virtualizes SMX, presents a virtual TPM and emulates the TXT memory map so tboot and kernel utilities see valid PCRs while hardware never runs getsec; proof‑of‑concept reproduces identical PCR values and boots trusted software anyway. Also intercepts AES‑NI by toggling CR4 to force VM‑exits on XMM/YMM use and capture AES keys and plaintext from registers; attack works but incurs measurable slowdown. Mitigations: use TPM sealed storage, display a per‑boot secret, or avoid AES‑NI.
AI-written summary · about
chapters (5)
- 0:00Start
- 12:31SENTER Emulation Attack with Hypervisor Rootkit
- 13:46SENTER Emulation Attack Discussion
- 22:04Fundamental Problem
- 38:18Sealed Storage: Challenges
related talks
15mRemote Attestation in AMD SEV-SNP Confidential VMs
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
27mProtecting Data In-Use from Firmware and Physical Attacks
41mProtected Execution Facility
55mProtected Execution Facility On Power
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security
41mSimulation Hacking, the Good, Bad and the Ugly
41mUnifying Confidential Attestation