Thursday, December 5, 2024
HomeCyber AttackDownfall Attack Enables Extraction of Passwords and Encryption Key From Intel Microprocessor

Downfall Attack Enables Extraction of Passwords and Encryption Key From Intel Microprocessor

Published on

SIEM as a Service

Gather Data Sampling (GDS) impacts select Intel CPUs, enabling attackers to deduce outdated data through malicious use of gather instructions. While all these entries link to the prior thread or sibling core registers.

Like MDS, GDS (Gather Data Sampling) enables local code execution to reveal protected secret data. GDS is different from MDS as it exposes only stale vector register data through specific gathering instructions, lacking user choice in suspected data.

Cybersecurity researcher Daniel Moghimi at Google recently crafted a ‘Downfall’ CPU attack that enables threat actors to extract the following data from Intel chips shared by users:- 

- Advertisement - SIEM as a Service
  • Passwords
  • Keys
  • Emails
  • Banking

Cybersecurity researchers tracked this vulnerability as CVE-2022-40982, and this flaw affects the Skylake to Ice Lake chips from Intel with transient execution side-channel issues.

Flaw profile

  • CVE ID: CVE-2022-40982
  • Description: Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to enable information disclosure via local access potentially.
  • CVSS Base Score: 6.5
  • Severity: MEDIUM
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Technical analysis

By exploiting this vulnerability, a threat actor can easily retrieve the protected sensitive data through Intel’s SGX, which segregates the code and memory.

Besides this, the SGX exclusively aids the server CPUs which enables it to establish a secure enclave that is inaccessible even by the OS itself.

Moreover, Daniel Moghimi revealed the exploitative nature of Downfall, under which this flaw exploits the gathered instructions for a speculative leak of vector register content.

Moghimi seized AES keys through GDS across VMs, even from cores’ sibling threads. In under 10s, 8 bytes at a time, the researcher fused stolen AES round keys to crack encryption.

However, apart from this, the researcher leveraged the undisclosed techniques in this scenario on powerful CPUs to breach data barriers between:-

  • User-kernel
  • Processes
  • VMs
  • Secure execution domains

Failed tries prompted repeated attacks, as the master key data was infrequent within 10 seconds. Moghimi offers diverse GDS attacks, snatching varied data due to specific SIMD buffer conditions.

Affected CPU families

Downfall needs attacker presence on the victim’s physical core, facilitated by current shared computing.

Local malware might exploit it, and besides this, Intel already acknowledged the flaw with Moghimi in August, issuing a microcode fix.

Vulnerability remained undisclosed for nearly a year, allowing OEMs and CSPs to validate fixes.

But, Intel affirms that Alder Lake, Raptor Lake, and Sapphire Rapids series were not affected, as the Downfall affects the following CPU families:-

  • Skylake
  • Cascade Lake
  • Cooper Lake
  • Amber Lake
  • Kaby Lake
  • Coffee Lake
  • Whiskey Lake
  • Comet Lake
  • Tiger Lake family
  • Ice Lake
  • Rocket Lake

In this case, to leak data, Daniel Moghimi exploited the REDACTED on high-performance REDACTED CPUs by breaching the user-kernel boundaries across systems.

Recommendations

Here below, we have mentioned all the recommendations from Intel:-

  • For enhanced security, Intel advises users of affected processors to install the latest firmware from their system manufacturer.
  • Intel suggests SGX users update platform flash microcode via firmware interface table.
  • Intel’s new microcode update prevents the attackers from observing gather instruction results.
  • To counter this flaw, an SGX TCB recovery is in the works.
  • Non-Intel (SGX) systems can apply microcode fixes via OS loading.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

ChatGPT Next Web Vulnerability Let Attackers Exploit Endpoint to Perform SSRF

Researchers released a detailed report on a significant security vulnerability named CVE-2023-49785, affecting the...

Cisco NX-OS Vulnerability Allows Attackers to Bypass Image Signature Verification

A critical vulnerability has been identified in the bootloader of Cisco NX-OS Software, potentially...

Deloitte UK Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data

Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte...

Cloudflare Developer Domains Abused For Cyber Attacks

Cloudflare Pages, a popular web deployment platform, is exploited by threat actors to host...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

ChatGPT Next Web Vulnerability Let Attackers Exploit Endpoint to Perform SSRF

Researchers released a detailed report on a significant security vulnerability named CVE-2023-49785, affecting the...

Cisco NX-OS Vulnerability Allows Attackers to Bypass Image Signature Verification

A critical vulnerability has been identified in the bootloader of Cisco NX-OS Software, potentially...

Deloitte UK Hacked – Brain Cipher Group Claim to Have Stolen 1 TB of Data

Brain Cipher has claimed to have breached Deloitte UK and exfiltrated over 1 terabyte...