practical enclave malware with intel sgx
play

Practical Enclave Malware with Intel SGX Michael Schwarz, Samuel - PowerPoint PPT Presentation

Feb 24, 2023 •339 likes •1.34k views

Practical Enclave Malware with Intel SGX Michael Schwarz, Samuel Weiser, Daniel Gruss June 20, 2019 - DIMVA19 Graz University of Technology www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss Graz University of

  1. Practical Enclave Malware with Intel SGX Michael Schwarz, Samuel Weiser, Daniel Gruss June 20, 2019 - DIMVA’19 Graz University of Technology

  2. www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  3. www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  4. www.tugraz.at Outline SGX 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  5. www.tugraz.at Outline 2 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  6. www.tugraz.at SGX Application Untrusted part Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  7. www.tugraz.at SGX Application Untrusted part Create Enclave Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  8. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  9. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  10. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  11. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  12. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  13. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  14. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return . . . Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  15. www.tugraz.at SGX Application Untrusted part Trusted part Create Enclave Call Gate Trusted Fnc. Call Trusted Fnc. Return . . . Operating System 3 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  16. www.tugraz.at What if? • Enclaves are black boxes 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  17. www.tugraz.at What if? • Enclaves are black boxes • Protected from all applications and OS 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  18. www.tugraz.at What if? • Enclaves are black boxes • Protected from all applications and OS • What if they contain malicious code? 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  19. www.tugraz.at What if? • Enclaves are black boxes • Protected from all applications and OS • What if they contain malicious code? • Can we hide zero days? 4 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  20. www.tugraz.at Threat Model Intel’s Statement [...] Intel is aware of this research which is based upon assumptions that are outside the threat model for Intel SGX. The value of Intel SGX is to execute code in a protected enclave; however, Intel SGX does not guarantee that the code executed in the enclave is from a trusted source [...] 5 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  21. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  22. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  23. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls • No shared memory/libraries 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  24. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls • No shared memory/libraries • No interprocess communication 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  25. www.tugraz.at SGX Limitations Classical exploits cannot be mounted within SGX: • No syscalls • No shared memory/libraries • No interprocess communication • Blocked instructions 6 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  26. www.tugraz.at State-of-the-art Malicious Enclaves • Side-channel attacks from SGX [Sch+17] 7 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  27. www.tugraz.at State-of-the-art Malicious Enclaves • Side-channel attacks from SGX [Sch+17] • Fault attacks from SGX [Gru+18; Jan+17] 7 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  28. www.tugraz.at State-of-the-art Malicious Enclaves • Side-channel attacks from SGX [Sch+17] • Fault attacks from SGX [Gru+18; Jan+17] • No real exploits from SGX so far 7 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  29. www.tugraz.at TEE-REX TEE - REX T E E R EX rusted xecution nvironment eturn-oriented-programming ploit 8 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  30. www.tugraz.at Attack Overview Data Code Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  31. www.tugraz.at Attack Overview Data Read Primitive ( TAP ) Gadget Code Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  32. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive ( TAP ) Gadget Code Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  33. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  34. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  35. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive execute ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  36. www.tugraz.at Attack Overview Write Primitive ( CLAW ) Cave Data Read Primitive execute ( TAP ) Gadget Code ROP injection chain Stack Enclave 9 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  37. www.tugraz.at Problems • Enclave can access host memory... 10 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  38. www.tugraz.at Problems • Enclave can access host memory... • ...but crashes on invalid access 10 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  39. www.tugraz.at Problems • Enclave can access host memory... • ...but crashes on invalid access • No syscall or exception handler available 10 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  40. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  41. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  42. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic • Operations in a transaction 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  43. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic • Operations in a transaction • Conflict → abort and roll back 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  44. www.tugraz.at Transactional Memory • Intel TSX: hardware transactional memory • Multiple reads and writes are atomic • Operations in a transaction • Conflict → abort and roll back • Faults are suppressed 11 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

  45. www.tugraz.at Transactional Memory Thread 0 Cache Thread 1 12 Michael Schwarz , Samuel Weiser, Daniel Gruss — Graz University of Technology

Recommend

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen

The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 Introduction 2/18 What is Intel SGX? Intel Software Guard Extension (SGX) A vault (enclave) to

353 views • 19 slides
Hardware Enclave Attacks CS261 Threat Model of Hardware Enclaves Intel Attestation Process

Hardware Enclave Attacks CS261 Threat Model of Hardware Enclaves Intel Attestation Process

Hardware Enclave Attacks CS261 Threat Model of Hardware Enclaves Intel Attestation Process Service Untrusted (IAS) Enclave Enclave Code Trusted Process Process Enclave Other Data Enclave OS and/or Hypervisor Off-chip devices 2

531 views • 24 slides
Practical implications of Intel SGX with Graphene July 4th, 2019 Derk Barten Robin Klusman

Practical implications of Intel SGX with Graphene July 4th, 2019 Derk Barten Robin Klusman

Practical implications of Intel SGX with Graphene July 4th, 2019 Derk Barten Robin Klusman Software Guard Untrusted system Trusted enclave Extensions Attestation (SGX) Encrypted & isolated memory Integrity,

266 views • 22 slides
IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code for applications and malware is not

1.1k views • 58 slides
From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues

From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues

From SOC to Analyst: bridging automated and manual analyses Practical Considerations and Issues July, 10th 2017 Raphal Rigo Typical (ideal) workflow of a malware sample reverser binary SOC CERT special malware malware SOC

89 views • 7 slides
T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs Ming-Wei Shih Sangho Lee

T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs Ming-Wei Shih Sangho Lee

T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs Ming-Wei Shih Sangho Lee Taesoo Kim Marcus Peinado Georgia Institute of Technology Microsoft Research 2 3 Intel SGX aims to secure users code and data in the cloud

1.07k views • 27 slides
S GX E LIDE : Enabling Enclave Code Secrecy via Self-Modification Erick Bauman 1 , Huibo Wang 1 ,

S GX E LIDE : Enabling Enclave Code Secrecy via Self-Modification Erick Bauman 1 , Huibo Wang 1 ,

S GX E LIDE : Enabling Enclave Code Secrecy via Self-Modification Erick Bauman 1 , Huibo Wang 1 , Mingwei Zhang 2 , Zhiqiang Lin 1 , 3 1 University of Texas at Dallas 2 Intel Labs 3 The Ohio State University CGO 2018 Introduction Background and

1.08k views • 74 slides
Bringing Memory-Safety to Keystone Enclave Mingshen Sun Baidu X-Lab Open-Source Enclaves Workshop

Bringing Memory-Safety to Keystone Enclave Mingshen Sun Baidu X-Lab Open-Source Enclaves Workshop

Bringing Memory-Safety to Keystone Enclave Mingshen Sun Baidu X-Lab Open-Source Enclaves Workshop (OSEW 2019) Berkeley, July 2019 https://mesatee.org Rust and Keystone Enclave Open-Source Enclave (RISC-V Hardware/Keystone Enclave) :

662 views • 32 slides
MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat

MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat

MISP Workbench - Because you know better MISP - Malware Information Sharing Platform & Threat Sharing Marion Marschalek - Rapha el Vinot - TLP:WHITE July 6, 2016 MISP and starting from a practical use-case During a malware analysis

357 views • 18 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Intel AMT: Using & Abusing the Ghost in the Machine Parth Shukla - timevortex@google.com

Intel AMT: Using & Abusing the Ghost in the Machine Parth Shukla - timevortex@google.com

Intel AMT: Using & Abusing the Ghost in the Machine Parth Shukla - timevortex@google.com Enterprise Infrastructure Protection 1 Project Goals 1 Explore the best* practical attack using Intel AMT 2 Present a holistic perspective

808 views • 48 slides
Malware Analysis at AIRBUS Practical Considerations and Issues July, 12th 2017 Xavier

Malware Analysis at AIRBUS Practical Considerations and Issues July, 12th 2017 Xavier

Malware Analysis at AIRBUS Practical Considerations and Issues July, 12th 2017 Xavier Mehrenberger, Raphal Rigo, Sarah Zennou Plan Introduction Automated analysis Machine learning experiments 2 M. Mehrenberger, R. Rigo, S. Zennou ::

637 views • 12 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Verifying enclave systems with Serval Luke Nelson w/ James Bornholt, Ronghui Gu, Andrew Baumann,

Verifying enclave systems with Serval Luke Nelson w/ James Bornholt, Ronghui Gu, Andrew Baumann,

Open Source Enclave Workshop July 2019 Berkeley, CA Verifying enclave systems with Serval Luke Nelson w/ James Bornholt, Ronghui Gu, Andrew Baumann, Emina Torlak, Xi Wang University of Washington, Columbia University, Microsoft Research 1

435 views • 14 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Autarky: Closing controlled channels with self-paging enclaves Meni Orenbach, Technion Andrew

Autarky: Closing controlled channels with self-paging enclaves Meni Orenbach, Technion Andrew

Autarky: Closing controlled channels with self-paging enclaves Meni Orenbach, Technion Andrew Baumann, Microsoft Research Mark Silberstein, Technion Public cloud computing Enclave Enclave Enclave Sensitive data 29-Apr-20 Meni Orenbach,

971 views • 29 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides

More recommend