Reliable, bug-free computer hardware provides the foundation for secure software. Now, vulnerabilities on the hardware side are increasingly attracting the attention of hackers and developers alike, not least following the discovery of the Meltdown and Spectre side-channel attacks by TU Graz researchers in 2018. Since then, researchers – including from TU Graz – have uncovered a series of new openings for cyberattacks that capitalise on weaknesses in PC hardware. A team headed by Daniel Gruss of the Institute of Applied Information Processing and Communications has now published details of two further vulnerabilities: Æpic Leak and SQUIP.
Æpic Leak: no side-channel required
In autumn 2021, Rome-based researcher Pietro Borrello came across a new form of attack during a research visit as part of the TU Graz team led by IT security expert Daniel Gruss. “As with all of the vulnerabilities we discover, we first reported the problem to the manufacturer – in this case Intel – and gave them the time they needed to provide fixes,” Gruss explains. This period has expired, and working in coordination with Intel the researchers have now published details of the attack, which is called Æpic Leak.
Æpic Leak (Architecturally Leaking Uninitialized Data from the Microarchitecture) is the first attack that can obtain data directly from the microarchitecture of the central processing unit (CPU) without using side channel information. The attack takes advantage of a flaw in the hardware in order to directly access data in the CPU’s internal storage unit that is yet to be overwritten. This includes sensitive data from Intel Software Guard Extensions (SGX) enclaves (an isolated section of the CPU that securely processes sensitive data separately from the rest of the system), which is actually designed to protect the system against attacks such as malware.
CPUs based on the Sunny Cove microarchitecture, and other CPUs produced by Intel, are affected by the vulnerability. Intel has already developed the necessary fixes and today released the server versions – although SGX has now been dispensed with completely for client applications. New processors will reportedly feature integrated solutions – but, as the researchers point out: “We know that the idea of a general solution for such architecture-based weaknesses and similar vulnerabilities requires further research. It’s a question that still needs to be answered.” In the release, the researchers also show that hardware vulnerabilities follow the same pattern as weaknesses in software. But in contrast to software, the task of identifying hardware flaws and working out how to avoid them is still at a very early stage.
However, because Æpic Leak can only be carried out at a very high security level – administrator or root – the vast majority of systems are secure. Details of Æpic Leak will be presented this week at the prestigious USENIX Security Symposium in Boston and at the BlackHat Conference in Las Vegas.
Æpic Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture. Pietro Borrello (Sapiens University of Rome), Andreas Kogler (TU Graz), Martin Schwarzl (TU Graz), Moritz Lipp (Amazon Web Services), Daniel Gruss (TU Graz) und Michael Schwarz (CISPA Helmholtz Center for Information Security). USENIX Security Symposium 2022.
SQUIP: another side-channel attack
At the same time, Daniel Gruss and his team released information on another attack that was also recently discovered: SQUIP (Exploiting the Scheduler Queue Contention Side Channel). Rather than directly targeting data, this form of side-channel attack instead draws inferences about information based on observations of time-related correlations. SQUIP is the first attack to use scheduler queues, which manage the chronological order and organisation of processing steps. These system sub-sections had not previously been targeted because, compared with the more commonly used Intel chips, they did not offer any advantages over other modes of attack – but they certainly do open the door for attacks on chips from another major manufacturer, AMD, as well as some Apple chips. "Our attack exploits the limited capacity of the scheduler queue for multiplications. If this runs full, then the processor must wait until space becomes free again. We measure these waiting times and use them to draw conclusions about the program flow," says Stefan Gast.
SQUIP: Exploiting the Scheduler Queue Contention Side Channel. Stefan Gast (Lamarr Security Research, TU Graz), Jonas Juffinger (Lamarr Security Research, TU Graz), Martin Schwarz (TU Graz), Gururaj Saileshwar (Georgia Institute of Technology), Andreas Kogler (TU Graz), Simone Franza (TU Graz), Markus Köstl (TU Graz) und Daniel Gruss (TU Graz).
Other attacks (co)discovered by TU Graz:
• Meltdown and Spectre
• ZombieLoad and Store-to-leak
• PLATYPUS
