Tuesday, March 19, 2024

“Super Malware” Steals Encryption Keys From Intel SGX Isolated Memory Fields

A scientist’s Team from Graz University of Technology revealed the method that leaking theĀ  encryption data from Intel SGX (Software Guard Extensions ) enclaves which is called Isolated Memory FIeld .

Intel SGX is a set of new instructions from Intel that allows user-level code to allocate private regions of memory, called enclaves, that unlike normal process memory is also protected from processes running at higher privilege levels.

Security Research Team develop this”super Malware” under PoC (Proof of Concepts) and they Explained in their Research Paper , how this “Super Malware” leak the data from Isolated memory field by cache attack .

Also explained about the Attack Vector ,

Our proof-of-concept malware is able to recover RSA keys by monitoring cache access patterns of an RSA signature process in a semi-synchronous attack,” researchers said.In a semi-synchronous attack, we extract 96% of an RSA private key from a single trace,” they said. “We extract the full RSA private key in an automated attack from 11 traces within 5 minutes.

Researcher Explained in their Research Paper,Ā  “we show that it is very well possible for enclave malware to attack its hosting system. We demonstrate a cache attack from within a malicious enclave that is ex-tracting secret keys from co-located enclaves.”

“Our proof-of-concept malware is able to recover RSA keys by monitoring cache access patterns of an RSA signature process in a semi-module.”

This protects enclaves against hardware attacks trying to read or manipulate enclave content in DRAM.Creation and loading of enclaves are done by the oper-ating system.

“Super Malware” hide from anti-virus scanners

Researchers said ,To protect the integrity of enclave code, the loading procedure is measured by the CPU.

“If the resulting measurement does not match the value specified by the enclave developer, the CPU will refuse to run the enclave.”

During enclave loading, the operating system has full access to the enclave binary.

“At this point anti-virus scanners can hook in to analyze the enclave binary before it is executed. Enclave malware will attempt to hide from anti-virus scanners by encrypting malicious payload.”

For More About : Super Malware

 Also Read:

Website

Latest articles

CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in...

E-Root Admin Sentenced to 42 Months in Prison for SellingĀ 350,000 Credentials

Tampa, FL ā€“ In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles