Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls • Hacker News Board

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#81

Post by johncolanduoni » Sat, Jun 10, 2017, 9:21 AM UTC

SXX wrote: post #80

MichaelGG wrote: post #79

Earlier quoted context omitted.

I think you might not understand SGX's capability. It's just a compute kernel. So if they're taking data from your system, that's still very visible. And if they are sending data, that's also visible. So, sure, it's handy to hide logic. So the WannaCry thing, you'd be able to see it does DNS queries, but not how it determined a certain outcome based on the inputs. But you can't hide, for instance, a keylogger.

I perfectly understand what you pointing to, but problem of black box running in every piece of software is massive. Anyone could use it to implement remote backdoor in software and then pretend it's just a DRM that talking with licensing server. Yeah it's could be detected when it's start to be active, but it's doesn't have to. It's could be idle on PC for years undetected just waiting for remote command, trigger or…

It's not a black box. SGX code is unencrypted even at runtime, and as long as its running that code has to remain present and unencrypted. You can detect it at any time, not just when it starts up.

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#82

Post by goosh453 » Sat, Jun 10, 2017, 2:12 PM UTC

is it possible to avoid this problem by using a good hardware-firewall? Or maybe only surfing through a tunnel on a beaglebone/raspberry?

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#83

Post by kakarot » Sat, Jun 10, 2017, 8:03 PM UTC

rasz wrote: post #78

kakarot wrote: post #53

Earlier quoted context omitted.

I have done that before, and I've just done it again, and I don't get anything. The only thing present on my system related to ME afaik is the MEI linux driver, which is pretty useless without a ME to talk to. According to ARK [0], vPRO is absent. I have done various other system queries and nothing has turned up. Anything else you want me to query? And where do you get this information that ME is present in all chip…

https://github.com/zamaudio/intelmetool sudo intelmetool -s Im pretty sure Intel BootGuard is ME based

I'll check this out tonight, thanks!

Re: Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls

#84

Post by SXX » Tue, Jun 13, 2017, 7:17 AM UTC

johncolanduoni wrote: post #81

SXX wrote: post #80

Earlier quoted context omitted.

I perfectly understand what you pointing to, but problem of black box running in every piece of software is massive. Anyone could use it to implement remote backdoor in software and then pretend it's just a DRM that talking with licensing server. Yeah it's could be detected when it's start to be active, but it's doesn't have to. It's could be idle on PC for years undetected just waiting for remote command, trigger or…

It's not a black box. SGX code is unencrypted even at runtime, and as long as its running that code has to remain present and unencrypted. You can detect it at any time, not just when it starts up.

A bit too late response, but anyway. There is already apps that use SGX to safely work with DRM or private keys. If there is a way keep keys secret what would stop anyone from implementing interpreters that will keep code secret?