Ahoi Attacks – New Attack Breaking VMs With Malicious Interrupts

Ahoy, which is often associated with communicating to ships, has now been playfully adopted in pirate language.

We coin ‘Ahoi,’ an anagram of ‘Iago,’ to pay tribute to research on interface attacks with TEEs.

Confidential computing, also referred to as trusted execution, protects sensitive computations on public cloud platforms. 

Hardware vendors provide trusted hardware that guarantees user code and data security from malicious actors.

Ahoi Attacks

Cloud providers now offer confidential computing via technologies like Intel SGX for process-level isolation and AMD SEV, Intel TDX, and ARM CCA for VM-level isolation as Confidential VMs (CVMs). 

SGX enclaves isolate single processes from other processes/OS, while CVMs allow deploying entire isolated VMs inaccessible to other tenants, provider’s hardware/software like hypervisors.

Document
Stop Advanced Phishing Attack With AI

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

CVMs enable better cloud-native confidential computing abstraction than SGX’s process-level model.

Interrupt management is done almost entirely by the hypervisor in CVMs. CVM security can be breached by Ahoi attacks using notifications.

The hypervisor virtualizes the delivery of interrupts necessary for the operation of CVMs.

This hooks physical interrupts, redirects them to corresponding virtual machines, and raises virtual interrupts.

As a result, the guest OS within this CVM handles these interrupts via their handlers and ultimately acknowledges them.

The hardware exception is mapped in “x86” to the interrupts 0 through 31.

An example of this is when a divide-by-zero occurs and raises interrupt 0, which the OS converts to SIGFPE for user-space delivery.

Applying for a custom handler is like calculating the non-weighted average of SIGFPE.

Ahoi attacks have virtual CPUs that are attacked using a hypervisor to inject malicious interrupts into them, which helps invoke interrupt handlers globally.

Execution flow leading to successful authentication (Source – Github)

Ahoi attacks can take advantage of the interrupts and signals, which were made for trusted hypervisor environments.

Projects like Heckler can demonstrate this, as they have demonstrated how to breach AMD SEV-SNP and Intel TDX to gain unauthorized access to CVMs. 

Moreover, such vulnerabilities extend even up to specialized interrupt interfaces such as AMD SEV’s VMM Communication Exception (#VC) meant for safe hypervisor-CVM communication. 

However, this interface can be used by hypervisors to perform malicious tasks that are executed without being caught by CVMs.

WeSee exploits AMD SEV-SNP’s flaws to do forbidden things on CVMs.

Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

6 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

6 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

6 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

6 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago