{"id":53866,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx"},"modified":"2020-02-18T14:01:48","modified_gmt":"2020-02-18T11:01:48","slug":"plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","title":{"rendered":"Plundervolt \u2014 een nieuwe aanvalsmethode op Intel-processors, die de SGX-technologie aantast","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Intel Corporation heeft uitgebracht<\/a><\/noindex> microcode-update die het probleem oplost kwetsbaarheid<\/a><\/noindex> (CVE-2019-14607), die het mogelijk maakt<\/a><\/noindex> door manipulatie van de dynamische spannings- en frequentiecontrolemechanismen in de CPU schade aan de inhoud van geheugencellen te veroorzaken, inclusief in gebieden die worden gebruikt tijdens berekeningen in ge\u00efsoleerde enclaves van Intel SGX. De aanval is aangeduid als Plundervolt en stelt een lokale gebruiker in staat om hun privileges binnen het systeem te verhogen, een denial-of-service te veroorzaken en toegang te krijgen tot vertrouwelijke gegevens.<\/p>\n

De aanval vormt alleen een gevaar in de context van berekeningen in de SGX-enclaves, aangezien deze rootrechten in het systeem vereist. In de eenvoudigste gevallen kan de aanvaller vervormingen in de informatie die in de enclave wordt verwerkt, veroorzaken, maar in complexere scenario's is het niet uitgesloten dat opgeslagen vertrouwelijke sleutels die worden gebruikt voor encryptie met behulp van RSA-CRT en AES-NI-algoritmen opnieuw kunnen worden gecre\u00eberd. Deze techniek kan ook worden gebruikt om fouten te genereren in aanvankelijk correcte algoritmen om kwetsbaarheden bij geheugenwerking uit te lokken, bijvoorbeeld door toegang te krijgen tot gebieden buiten de toegewezen buffer.
\nPrototypecode voor het uitvoeren van de aanval gepubliceerd<\/a><\/noindex> op GitHub<\/p>\n

De essentie van de methode ligt in het cre\u00ebren van omstandigheden voor het ontstaan van onverwachte vervormingen van gegevens tijdens berekeningen in SGX, waartegen encryptie en geheugenauthenticatie in de enclave geen bescherming bieden. Vervormingen kunnen worden veroorzaakt met behulp van standaard softwareinterfaces voor het beheer van frequentie en spanning, die normaal worden gebruikt om het energieverbruik tijdens systeemidle te verlagen en maximale prestaties te activeren tijdens intensieve taken. De frequentie- en spanningskenmerken bestrijken de gehele chip en be\u00efnvloeden ook de berekeningen in de ge\u00efsoleerde enclave. <\/p>\n

Door spanning te vari\u00ebren, kunnen voorwaarden worden gecre\u00eberd waaronder de lading onvoldoende is voor de regeneratie van de geheugencel binnen de CPU, waardoor de waarde verandert. Het belangrijkste verschil met de aanval RowHammer<\/a><\/noindex> is what RowHammer allows to change the contents of individual bits in DRAM memory through cyclically reading data from neighboring cells, while Plundervolt allows for bit alteration within the CPU when data has already been loaded from memory for computation. This characteristic allows bypassing the integrity and encryption controls applied in SGX, as the values in memory remain correct but may be distorted during operations on them before the result is written back to memory.<\/p>\n

If this altered value is used in the multiplication process during encryption, the output will yield an incorrect ciphertext. Having the ability to access the handler in SGX for encrypting their data, an attacker can accumulate statistics on the changes in the ciphertext output by invoking faults, and within minutes recover the value of the key stored in the enclave. The original text at the input and the correct ciphertext at the output are known, the key is unchanged, and the output of incorrect ciphertext indicates distortion of some bit to the opposite value. <\/p>\n

By analyzing the accumulated pairs of correct and distorted ciphertexts obtained during various faults using differential fault analysis methods (DFA, Differential Fault Analysis<\/a><\/noindex>) it is possible to predict<\/a><\/noindex> likely keys used for symmetric AES encryption, and then, by analyzing the intersections of keys in different sets, determine the sought key.<\/p>\n

\r\n \"Video\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Various models of Intel processors are susceptible to this issue, including Intel Core CPUs from the 6th
\n to the 10th generation, as well as the fifth and sixth generations of Xeon E3, the first and second generations of Intel Xeon Scalable, Xeon D,
\nXeon W, and Xeon E.<\/p>\n

Recall that the SGX technology (Software Guard Extensions<\/a><\/noindex>) appeared in Intel Core processors of the sixth generation (Skylake) and Wat betreft de tweede IT-gigant, hun<\/a><\/noindex> een reeks instructies die applicaties van het gebruikersniveau in staat stellen om gesloten geheugengebieden - enclaves - te isoleren, waarvan de inhoud niet kan worden gelezen of gewijzigd, zelfs niet door de kernel of code die draait in de ring0-, SMM- en VMM-modi. Het is niet mogelijk om de controle over de code in de enclave over te dragen met traditionele sprongfuncties en manipulaties met registers en de stack - voor de overdracht van controle naar de enclave wordt een speciaal ontworpen nieuwe instructie gebruikt die de bevoegdheden controleert. Hierbij kan de code in de enclave klassieke aanroepmethoden gebruiken om functies binnen de enclave aan te roepen en een speciale instructie voor het aanroepen van externe functies. Ter bescherming tegen hardware-aanvallen, zoals het aansluiten op een DRAM-module, wordt geheugen van de enclave versleuteld.<\/p>\n

<\/a><\/noindex><\/p>\n

Bron: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-14607), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u0435\u043c \u0438 \u0447\u0430\u0441\u0442\u043e\u0442\u043e\u0439 \u0432 CPU \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u044f\u0447\u0435\u0435\u043a \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f\u0445 \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u043d\u043a\u043b\u0430\u0432\u0430\u0445 Intel SGX. \u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Plundervolt, \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0437\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Plundervolt - een nieuwe aanvalsmethode op Intel-processors die betrekking heeft op SGX-technologie | ProHoster","description":"Intel heeft een microcode-update uitgebracht die het verhelpt","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Plundervolt \u2014 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u044b Intel, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e SGX | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u0434\u0430, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0433\u043e","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/plundervolt-novyj-metod-ataki-na-protsessory-intel-zatragivayushhij-tehnologiyu-sgx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:05:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:28","updated":"2026-01-24 09:05:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/53866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=53866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/53866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=53866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=53866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=53866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}