Monday, February 17, 2025
HomeMalware"Super Malware" Steals Encryption Keys From Intel SGX Isolated Memory Fields

“Super Malware” Steals Encryption Keys From Intel SGX Isolated Memory Fields

Published on

SIEM as a Service

Follow Us on Google News

A scientist’s Team from Graz University of Technology revealed the method that leaking theĀ  encryption data from Intel SGX (Software Guard Extensions ) enclaves which is called Isolated Memory FIeld .

Intel SGX is a set of new instructions from Intel that allows user-level code to allocate private regions of memory, called enclaves, that unlike normal process memory is also protected from processes running at higher privilege levels.

Security Research Team develop this”super Malware” under PoC (Proof of Concepts) and they Explained in their Research Paper , how this “Super Malware” leak the data from Isolated memory field by cache attack .

Also explained about the Attack Vector ,

Our proof-of-concept malware is able to recover RSA keys by monitoring cache access patterns of an RSA signature process in a semi-synchronous attack,” researchers said.In a semi-synchronous attack, we extract 96% of an RSA private key from a single trace,” they said. “We extract the full RSA private key in an automated attack from 11 traces within 5 minutes.

Researcher Explained in their Research Paper,Ā  “we show that it is very well possible for enclave malware to attack its hosting system. We demonstrate a cache attack from within a malicious enclave that is ex-tracting secret keys from co-located enclaves.”

“Our proof-of-concept malware is able to recover RSA keys by monitoring cache access patterns of an RSA signature process in a semi-module.”

This protects enclaves against hardware attacks trying to read or manipulate enclave content in DRAM.Creation and loading of enclaves are done by the oper-ating system.

“Super Malware” hide from anti-virus scanners

Researchers said ,To protect the integrity of enclave code, the loading procedure is measured by the CPU.

“If the resulting measurement does not match the value specified by the enclave developer, the CPU will refuse to run the enclave.”

During enclave loading, the operating system has full access to the enclave binary.

“At this point anti-virus scanners can hook in to analyze the enclave binary before it is executed. Enclave malware will attempt to hide from anti-virus scanners by encrypting malicious payload.”

For More About : Super Malware

 Also Read:

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Androidā€™s New Security Feature Prevents Sensitive Setting Changes During Calls

Phone scams are becoming more sophisticated with advancements in AI-driven speech tools, making it...

Hackers Exploit Microsoft Teams Invites to Gain Unauthorized Access

The Microsoft Threat Intelligence Center (MSTIC) has uncovered an ongoing and sophisticated phishing campaign...

Meta’s Bug Bounty Initiative Pays $2.3 Million to Security Researchers in 2024

Meta's commitment to cybersecurity took center stage in 2024 as the tech giant awarded...

Google Chrome Introduces AI to Block Malicious Websites and Downloads

Google has taken a significant step in enhancing internet safety by integrating artificial intelligence...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0ā€™s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products ā€“ Indusface) and Phani Deepak Akella (VP of Marketing ā€“ Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick...

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...