Hackers Can Mess With Voltages to Steal Intel Chips’ Secrets

#News(Security) [ via IoTGroup ]

Headings…
Hackers Can Mess With Voltages to Steal Intel Chips’ Secrets
A new attack called Plundervolt gives attackers access to the sensitive dat

Auto extracted Text……

Two teams of researchers—one at the University of Birmingham in the UK, TU Graz in Vienna, KU Leuven in Belgium and another at the Technische Universität Darmstadt in Germany and the University of California—have found a new technique that can allow hackers to fiddle with the voltage of Intel chips to cause them to leak information stored using Intel’s Secure Guard Extensions feature.
The technique, which one of the two teams calls Plundervolt, involves planting malicious software on a target computer that temporarily reduces the voltage of the electricity flowing to an Intel chip.
(By that same token, you can use the voltage-variance feature to “overclock” a processor for more intensive tasks.) But by momentarily undervolting a processor by 25 or 30 percent, and precisely timing that voltage change, an attacker can cause the chip to make errors in the midst of computations that use secret data.
Once the researchers found that they could use voltage changes to induce those faults—a so-called fault injection or “bit flip” that turns a one to a zero in the SGX enclave or vice versa—they showed that they could also exploit them.
The researchers also showed that they could use those bit flips to make the processor write to an unprotected portion of memory rather than to the secure SGX enclave:
That technique, which the Tsinghua and Maryland researchers called VoltJockey, used voltage changes to undermine the security of processors in much the same way as Plundervolt, but focuses on chips from ARM chips rather than Intel.
Other earlier attacks like Spectre and Foreshadow, which both exploited the speculative execution feature of Intel’s chips, could also in some cases break the confidentiality of the Intel’s SGX enclaves before the chipmaker released firmware patches to prevent them

Read More..
AutoTextExtraction by Working BoT using SmartNews 1.02976805238 Build 26 Aug 2019