practical enclave malware with intel sgx
play

Practical Enclave Malware with Intel SGX Michael Schwarz, Samuel - PowerPoint PPT Presentation

Feb 24, 2023 •339 likes •1.34k views

Practical Enclave Malware with Intel SGX Michael Schwarz, Samuel Weiser, Daniel Gruss June 20, 2019 - DIMVA19 Graz University of Technology www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss Graz University of

  1. Practical Enclave Malware with Intel SGX Michael Schwarz, Samuel Weiser, Daniel Gruss June 20, 2019 - DIMVA’19 Graz University of Technology

  2. www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  3. www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  4. www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  5. www.tugraz.at Outline 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  6. www.tugraz.at SGX Application Untrusted part Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  7. www.tugraz.at SGX Application Untrusted part Create Enclave Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  8. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  9. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  10. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  11. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  12. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  13. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  14. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return . . . Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  15. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return . . . Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  16. www.tugraz.at What if? • Enclaves are black boxes 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  17. www.tugraz.at What if? • Enclaves are black boxes • Protected from all applications and OS 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  18. www.tugraz.at What if? • Enclaves are black boxes • Protected from all applications and OS • What if they contain malicious code? 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  19. www.tugraz.at What if? • Enclaves are black boxes • Protected from all applications and OS • What if they contain malicious code? • Can we hide zero days? 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  20. www.tugraz.at Threat Model Intel’s Statement [...] Intel is aware of this research which is based upon assumptions that are outside the threat model for Intel SGX. The value of Intel SGX is to execute code in a protected enclave; however, Intel SGX does not guarantee that the code executed in the enclave is from a trusted source [...] 5 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  21. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  22. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  23. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls • No shared memory/libraries 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  24. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls • No shared memory/libraries • No interprocess communication 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  25. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls • No shared memory/libraries • No interprocess communication • Blocked instructions 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  26. www.tugraz.at State-of-the-art Malicious Enclaves • Side-channel attacks from SGX [Sch+17] 7 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  27. www.tugraz.at State-of-the-art Malicious Enclaves • Side-channel attacks from SGX [Sch+17] • Fault attacks from SGX [Gru+18; Jan+17] 7 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  28. www.tugraz.at State-of-the-art Malicious Enclaves • Side-channel attacks from SGX [Sch+17] • Fault attacks from SGX [Gru+18; Jan+17] • No real exploits from SGX so far 7 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  29. www.tugraz.at TEE-REX TEE - REX T E E R EX rusted xecution nvironment eturn-oriented-programming ploit 8 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  30. www.tugraz.at Attack Overview Data Code Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  31. www.tugraz.at Attack Overview Data Read Primitive ( TAP ) Gadget Code Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  32. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive ( TAP ) Gadget Code Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  33. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  34. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  35. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive execute ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  36. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive execute ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  37. www.tugraz.at Problems • Enclave can access host memory... 10 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  38. www.tugraz.at Problems • Enclave can access host memory... • ...but crashes on invalid access 10 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  39. www.tugraz.at Problems • Enclave can access host memory... • ...but crashes on invalid access • No syscall or exception handler available 10 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  40. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  41. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  42. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic • Operations in a transaction 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  43. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic • Operations in a transaction • Conflict → abort and roll back 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  44. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic • Operations in a transaction • Conflict → abort and roll back • Faults are suppressed 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  45. www.tugraz.at Transactional Memory Thread 0 Cache Thread 1 12 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 Introduction 2/18 What is Intel SGX? Intel Software Guard Extension (SGX) A vault (enclave) to

353 views • 19 slides
Hardware Enclave Attacks CS261 Threat Model of Hardware Enclaves Intel Attestation Process

Hardware Enclave Attacks CS261 Threat Model of Hardware Enclaves Intel Attestation Process

Hardware Enclave Attacks CS261 Threat Model of Hardware Enclaves Intel Attestation Process Service Untrusted (IAS) Enclave Enclave Code Trusted Process Process Enclave Other Data Enclave OS and/or Hypervisor Off-chip devices 2

531 views • 24 slides
Practical implications of Intel SGX with Graphene July 4th, 2019 Derk Barten Robin Klusman

Practical implications of Intel SGX with Graphene July 4th, 2019 Derk Barten Robin Klusman

Practical implications of Intel SGX with Graphene July 4th, 2019 Derk Barten Robin Klusman Software Guard Untrusted system Trusted enclave Extensions Attestation (SGX) Encrypted & isolated memory Integrity,

266 views • 22 slides
IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code for applications and malware is not

1.1k views • 58 slides
From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues

From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues

From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues July, 10th 2017 Raphal Rigo Typical (ideal) workflow of a malware sample reverser binary SOC CERT special malware malware SOC

89 views • 7 slides
T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs Ming-Wei Shih Sangho Lee

T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs Ming-Wei Shih Sangho Lee

T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs Ming-Wei Shih Sangho Lee Taesoo Kim Marcus Peinado Georgia Institute of Technology Microsoft Research 2 3 Intel SGX aims to secure users code and data in the cloud

1.07k views • 27 slides
S GX E LIDE : Enabling Enclave Code Secrecy via Self-Modification Erick Bauman 1 , Huibo Wang 1 ,

S GX E LIDE : Enabling Enclave Code Secrecy via Self-Modification Erick Bauman 1 , Huibo Wang 1 ,

S GX E LIDE : Enabling Enclave Code Secrecy via Self-Modification Erick Bauman 1 , Huibo Wang 1 , Mingwei Zhang 2 , Zhiqiang Lin 1 , 3 1 University of Texas at Dallas 2 Intel Labs 3 The Ohio State University CGO 2018 Introduction Background and

1.08k views • 74 slides
Bringing Memory-Safety to Keystone Enclave Mingshen Sun Baidu X-Lab Open-Source Enclaves Workshop

Bringing Memory-Safety to Keystone Enclave Mingshen Sun Baidu X-Lab Open-Source Enclaves Workshop

Bringing Memory-Safety to Keystone Enclave Mingshen Sun Baidu X-Lab Open-Source Enclaves Workshop (OSEW 2019) Berkeley, July 2019 https://mesatee.org Rust and Keystone Enclave Open-Source Enclave (RISC-V Hardware/Keystone Enclave) :

662 views • 32 slides
MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat

MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat

MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat Sharing Marion Marschalek - Rapha el Vinot - TLP:WHITE July 6, 2016 MISP and starting from a practical use-case During a malware analysis

357 views • 18 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

567 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Intel AMT: Using & Abusing the Ghost in the Machine Parth Shukla - timevortex@google.com

Intel AMT: Using & Abusing the Ghost in the Machine Parth Shukla - timevortex@google.com

Intel AMT: Using & Abusing the Ghost in the Machine Parth Shukla - timevortex@google.com Enterprise Infrastructure Protection 1 Project Goals 1 Explore the best* practical attack using Intel AMT 2 Present a holistic perspective

808 views • 48 slides
Malware Analysis at AIRBUS Practical Considerations and Issues July, 12th 2017 Xavier

Malware Analysis at AIRBUS Practical Considerations and Issues July, 12th 2017 Xavier

Malware Analysis at AIRBUS Practical Considerations and Issues July, 12th 2017 Xavier Mehrenberger, Raphal Rigo, Sarah Zennou Plan Introduction Automated analysis Machine learning experiments 2 M. Mehrenberger, R. Rigo, S. Zennou ::

637 views • 12 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Verifying enclave systems with Serval Luke Nelson w/ James Bornholt, Ronghui Gu, Andrew Baumann,

Verifying enclave systems with Serval Luke Nelson w/ James Bornholt, Ronghui Gu, Andrew Baumann,

Open Source Enclave Workshop July 2019 Berkeley, CA Verifying enclave systems with Serval Luke Nelson w/ James Bornholt, Ronghui Gu, Andrew Baumann, Emina Torlak, Xi Wang University of Washington, Columbia University, Microsoft Research 1

435 views • 14 slides
BP Midstream Partners 4Q and full year 2018 Results February 28, 2019 BP MAD DOG 1 BP

BP Midstream Partners 4Q and full year 2018 Results February 28, 2019 BP MAD DOG 1 BP

BP MIDSTREAM PARTNERS BP Midstream Partners 4Q and full year 2018 Results February 28, 2019 BP MAD DOG 1 BP MIDSTREAM PARTNERS 4Q & FULL YEAR 2018 RESULTS Offshore deepwater Gulf of Mexico Cautionary statement BP MIDSTREAM PARTNERS

456 views • 27 slides
Physics of Injection-induced Earthquakes Unveiled by Seismic Wave Analysis and Numerical Models

Physics of Injection-induced Earthquakes Unveiled by Seismic Wave Analysis and Numerical Models

Physics of Injection-induced Earthquakes Unveiled by Seismic Wave Analysis and Numerical Models Yihe Huang University of Michigan Injection-induced earthquakes : Earthquakes induced by fluid injection related to energy technologies including

756 views • 32 slides
Encrypted Search: Leakage Attacks Seny Kamara How do we Deal with Leakage? Our definitions

Encrypted Search: Leakage Attacks Seny Kamara How do we Deal with Leakage? Our definitions

SAC Summer School 2019 Encrypted Search: Leakage Attacks Seny Kamara How do we Deal with Leakage? Our definitions allow us to prove that our schemes achieve a certain leakage profile but doesnt tell us if a leakage profile is

477 views • 22 slides
End-to-end Injection Safety at Scale Mike Samuel, Google Security Engineering March 2019 2019 |

End-to-end Injection Safety at Scale Mike Samuel, Google Security Engineering March 2019 2019 |

End-to-end Injection Safety at Scale Mike Samuel, Google Security Engineering March 2019 2019 | About me Security engineer @ Google Hacks libraries, tools, languages TC39 member ( JavaScript language committee ) Editor of "A Roadmap

407 views • 29 slides
AVFI: Fault Injection for Autonomous Vehicles Fault Injection to Measure Resilience of AVs

AVFI: Fault Injection for Autonomous Vehicles Fault Injection to Measure Resilience of AVs

Saurabh Jha, Subho S. Banerjee , James Cyriac, Zbigniew T. Kalbarczyk and Ravishankar K. Iyer Computer Science, Electrical and Computer Engineering AVFI: Fault Injection for Autonomous Vehicles Fault Injection to Measure Resilience of AVs

215 views • 8 slides
Mycobacterium tuberculosis Mycobacterium tuberculosis Rv2224c modulates innate Rv2224c modulates

Mycobacterium tuberculosis Mycobacterium tuberculosis Rv2224c modulates innate Rv2224c modulates

Mycobacterium tuberculosis Mycobacterium tuberculosis Rv2224c modulates innate Rv2224c modulates innate immune responses immune responses Jyothi Rengarajan, Elissa Murphy, Arnold Park, Arnold Park, Cassandra L. Krone, Erik C. Hett, Barry R.

616 views • 37 slides
Expression profile of innate immune genes in peripheral blood mononuclear cells as early

Expression profile of innate immune genes in peripheral blood mononuclear cells as early

Expression profile of innate immune genes in peripheral blood mononuclear cells as early detection of breast cancer Nataliia Melnichuk 1, *, Tetiana Marchyshak 1 ,Vladimir Kashuba 1,2 , Ivan Smolanka 3 , Petro Okhrimenko 4 , and Zenoviy Tkachuk 1

248 views • 13 slides
University of Miami Office of Technology Transfer Jim

University of Miami Office of Technology Transfer Jim

University of Miami Office of Technology Transfer Jim OConnell Director MobileCARE: Documentation, Education and Telemedicine A New Era in Mobile Clinical Care The Problem The process

417 views • 27 slides

More recommend