Foreshadow: Extracting the Keys to the Intel SGX Kingdom...

on YouTube ↗25m

" summary

The talk explains Foreshadow, a software-only microarchitectural attack that exploits a speculative execution bug in modern Intel CPUs to break Intel SGX enclaves. It shows how the attack reads plaintext secrets from the CPU cache to extract full cryptographic keys and demonstrates forging of local and remote attestation using those keys, affecting millions of devices.

AI-written summary · about

" chapters (10)

1. 0:00Foreshadow vulnerability
2. 2:41Intel SGX security
3. 5:29Speculative execution attacks
4. 8:40Foreshadow’s SGX impact
5. 12:33Foreshadow exploit demo
6. 15:02Extracting SGX private keys
7. 17:54Foreshadow beyond SGX
8. 20:41Cloud systems consequences
9. 21:01Security research call
10. 21:46Q&A

" related talks

• 54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal BitcoinsMichael Schwarz, Moritz Lipp · Black Hat Asia 2018
• 48mSpeculative execution vulnerabilitiesRaoul Strackx · hardwear.io USA 2019
• 25mTelling Your Secrets without Page Faults...Raoul Strackx, Frank Piessens, Jo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza · 26th USENIX Security Symposium (USENIX Security '17)
• 51mKeynote |The Microarchitectures That I Saw And The Ones That I Hope To One Day SeeRodrigo Rubira Branco · Hardwear.io USA 2023
• 33mHacking in Darkness: Return-oriented Programming against Secure EnclavesYeongjin Jang, Taesoo Kim, Jaehyuk Lee, Jinsoo Jang, Nohyun Kwak, Yeseul Choi, Changho Choi, Marcus Peinado, Brent Byunghoon Kang · 26th USENIX Security Symposium (USENIX Security '17)
• 25mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 24mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019