Re-volting: AMD Secure Encrypted Virtualization undone by electrical attack
- Reference: 1628840106
- News link: https://www.theregister.co.uk/2021/08/13/amd_secure_encrypted_virtualization/
- Source link:
Boffins from the Technische Universität Berlin have devised an attack that defeats the primary purpose of this silicon safe room technology: protecting the data in virtual machines from rogue administrators in cloud environments.
In [1]a paper titled "One Glitch to Rule Them All: Fault Injection Attacks Against AMD’s Secure Encrypted Virtualization," Robert Buhren, Hans Niklas Jacob, Thilo Krachenfels, and Jean-Pierre Seifert from TU Berlin's Security in Telecommunications group, describe how they succeeded in mounting a voltage fault injection attack.
[2]
This shock to the system allowed them to recover secret encryption keys and execute arbitrary code on all AMD chips with Secure Processors (SP).
[3]
[4]
"By manipulating the input voltage to AMD systems on a chip (SoCs), we induce an error in the read-only memory (ROM) bootloader of the AMD-SP, allowing us to gain full control over this root-of-trust," the researchers explain in their paper.
The attack was inspired by a separate cunning plan, dubbed [5]Voltpillager , used to defeat Intel's Software Guard Extensions (SGX), a similar secure enclave system for x86 microarchitecture.
[6]
As with SGX, the SEV attack relies on cheap, off-the-shelf components: a ~$30 Teensy µController (microcontroller) and a $12 flash programmer. Non-material prerequisites pose more of a challenge – they include insider access at a cloud company, an opportunity to attach wires to the server motherboard without arousing suspicion, and some technical proficiency.
The Register asked AMD to comment. A spokesperson pointed to the physical access requirement to underscore this is not a remote attack scenario but otherwise didn't have anything to say.
[7]KVM flaw on AMD servers gave malicious VMs a route to take over the host
[8]Arm chief hits out at 'ill-informed speculation' over proposed Nvidia buyout
[9]Quantum Key Distribution: Is it as secure as claimed and what can it offer the enterprise?
[10]Please, no Moore: 'Law' that defined how chips have been made for decades has run itself into a cul-de-sac
SEV utilizes the Secure Processor, a microcontroller that provides the root of trust in AMD Naples (Zen 1), Rome (Zen 2), and Milan (Zen 3) chips and manages the VM lifecycle. It is supposed to protect VM data from the hypervisor and from other VMs.
But by lowering the voltage applied when the AMD-SP's ROM bootloader runs, the researchers were able to extract Chip Endorsement Keys (CEKs), which can be used to mount fully remote attacks.
The boffins were also able to defeat a new key-versioning scheme introduced by the SEV Secure Nested Paging (SEV-SNP) extension last year
[11]PDF
. Using the electrical glitch to extract the seed values for the Versioned Chip Endorsement Key (VCEK), they were able to derive the valid VCEKs for all possible combinations of firmware versions. This represents the first publicly disclosed attack on the SEV-SNP extension, they claim.[12]
The paper suggest two possible mitigation paths. One involves modifying software or hardware to detect voltage modulation in order to prevent execution in the presence of faults.
The other involves the addition of specific circuitry to defend against voltage glitches. The researchers observe that this is already routine for smartcards and point to a recent [13]Nvidia patent for a cross-domain voltage glitch detection circuit that can be implemented in an SoC. ®
Get our [14]Tech Resources
[1] https://arxiv.org/abs/2108.04575
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YRZC5TmrCAp64oWaTBbGjAAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YRZC5TmrCAp64oWaTBbGjAAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YRZC5TmrCAp64oWaTBbGjAAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2020/11/14/intel_sgx_physical_security/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YRZC5TmrCAp64oWaTBbGjAAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/06/30/kvm_flaw_on_amd_servers/
[8] https://www.theregister.com/2021/07/05/arm_chief_nvidia_buyout/
[9] https://www.theregister.com/2021/07/06/quantum_key_distribution/
[10] https://www.theregister.com/2021/08/05/moores_law_what_next/
[11] https://www.amd.com/system/files/TechDocs/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more.pdf
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YRZC5TmrCAp64oWaTBbGjAAAAAE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://patents.google.com/patent/US20200285780A1/en
[14] https://whitepapers.theregister.com/
Re: Really?
Not just access, but prolonged dismantling and internal interference without anyone noticing.
Hmmm. I wonder if there is some organisation (with a reputation for dirty tricks) that might be promoting this kind of research.
Re: Really?
" I wonder if there is some organisation ... that might be promoting this kind of research. "
Actually I think it's primarily because most attacks are perpetrated via bleeding obvious commonplace ages-old vectors, so the researchers have to find something new and interesting to occupy themselves with.
It would be preferable if they could focus their efforts on finding ways to eliminate the bleeding obvious commonplace ages-old vectors.
There's an episode of The Man from Uncle from 1962, in which an agent is tasked with finding ways to disrupt the organisation from outside. It turns out to be seriously easy - his final summing up is that they had taken great pains to protect themselves from obscure and esoteric attacks but had left themselves wide open to the commonplace. Still the case 59 years later?
Re: Really?
Obligatory [1]XKCD .
[1] https://xkcd.com/538/
Re: Really?
Or in the UK: Give us your passwords and passphrases or you're going to prison.
Re: Really?
And with that degree of access there are very likely a lot of easier ways.
Vector
The less you pay the admins, the more likely you'll get someone screwing up.
Would it just not..
Be cheaper/easier at scale/convenient to just include those chips in the motherboard building process?
Especially since it removed the need to physically access the device, compromise an admin or otherwise have a fleshy involved at the thin end of wedge/hack?
Really?
This is just another story pointing out that if someone with the right knowledge has physical access to your machines then you're fucked. This one's just a new flavour of fucked.