Computer scientists at ETH Zurich have uncovered critical vulnerabilities in the security mechanisms of AMD and Intel chips, potentially exposing sensitive data processed in public cloud environments to exploitation by hackers.
The discovery illuminates gaps in the confidential computing technologies employed by leading chip manufacturers, raising concerns about the efficacy of current security measures.
Vulnerabilities Found in AMD and Intel Chips
According to Shweta Shinde, a Professor of Computer Science at ETH Zurich, interrupts - the mechanisms that temporarily disrupt regular processing to prioritize different computing tasks - have been identified as a significant area of vulnerability.
Shinde's Secure & Trustworthy Systems Group conducted extensive research to pinpoint these vulnerabilities, which could compromise the integrity of data stored and processed within secure execution environments.
The team notes that confidential computing relies on trusted execution environments (TEEs) embedded within hardware to isolate and protect applications during execution. This hardware-based isolation is designed to prevent unauthorized access to sensitive data, safeguarding it from potential breaches.
However, the study conducted by ETH Zurich reveals that certain attack scenarios, such as the Ahoi and WeSee attacks, exploit the interaction between the TEE and hypervisor - a critical component of cloud computing architecture - to compromise the security of confidential computing environments.
The Ahoi attack, for instance, leverages coordinated interrupts directed at the TEE from an untrustworthy hypervisor, tricking the system into allowing unauthorized access.
According to Shinde, this attack method was particularly effective against AMD's confidential computing technology, exposing multiple vulnerabilities in AMD's defense mechanisms.
In the case of Intel, although only one interrupt door was found to be vulnerable, the overall security of the confidential computing environment remains a subject of concern.
Similarly, the WeSee attack targets a mechanism introduced by AMD to facilitate communication between the TEE and hypervisor, exploiting special interrupts to access sensitive data and execute external programs within the secure environment.
These vulnerabilities pose significant risks for companies and governmental organizations relying on public cloud services to process sensitive data.
Unchecked interruptions and insecure communication channels between TEEs and hypervisors undermine the fundamental principles of confidential computing, compromising data privacy and security, according to the researchers.
Beyond the implications for cloud computing security, Shweta Shinde's research group views this investigation as a stepping stone toward developing enhanced security measures for mobile devices.
A TEE for Protecting User Data
While identifying security vulnerabilities in sensitive data stored in the public cloud is crucial, for Shinde and her research group, this was incidental to their primary goal of empowering iPhone and Android smartphone users to maintain complete control over their data and applications.
Their focus is on developing a specially designed TEE that goes beyond protecting user data from eavesdropping by the manufacturer's operating system.
Shinde emphasizes the importance of enabling the unmonitored operation of apps not managed by Apple or Google using their TEE solution.
The team's findings were detailed in arXiv. Another paper was also published separately.
Related Article: UK's MoD Suffers Cyberattack, Compromising the Armed Forces' Personal Data
