Hacking in Darkness: Return-oriented Programming against Secure Enclaves
summary
Demonstrates a concrete exploit, Dark-ROP, that uses OS control plus oracle timing from SGX synchronous exits to discover and chain thousands (~13k) pop gadgets, then uses memcpy via ROP and ENCLU/EGAPKEY-style calls to exfiltrate enclave memory and retrieve sealing keys. The attack builds a shadow application that emulates the enclave and forces SGX to produce forged measurement reports, breaking remote attestation and fully disarming SGX confidentiality guarantees.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 4:05Cloud Services
- 4:31Intel SGX
- 4:55Memory Encryption
- 5:38Security guarantees
- 6:05How returnoriented programming works
- 6:58Unclips
- 8:32Tech Capability
- 11:01Pop Gadget
- 11:15Synchronous Enclave
- 14:34EnCLU
- 18:07EExit
- 18:42Example
- 23:30Conclusion
- 23:53Demonstration
- 27:58Questions
related talks
54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins
23mThe Guard's Dilemma: Efficient Code-Reuse Attacks Against Intel SGX
57mReturn Oriented Programming, an introduction
51mExploiting Hardware Glitches And Side Channels In Perfect Software
25mForeshadow: Extracting the Keys to the Intel SGX Kingdom...
34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves