A vulnerability in modern processors
breaks trusted execution environment.
VoltJockey is a critical vulnerability in modern processors. It is caused by the hardware features, which makes VoltJockey stealthy and hard to prevent. More importantly, the entire attack process is based on software without any involvement of hardware. With VoltJockey, attackers can get secret data that is securely protected by the trusted execution environment (such as TrustZone and SGX). This might include your passwords, fingerprint information, and even payment methods.
March 20, 2019: We successfully verified VoltJockey attack on Intel SGX (I7-8550U processor), which was later reported to Intel and will be finally published in AsianHOST 2019 at December 12, 2019. [Read]
April 12, 2018: We successfully verified VoltJockey attack on ARM TrustZone (Qualcomm APQ8084AB processor), which was later written a paper and published in ACM CCS’19 at November 11, 2019. [Read]
May 2017: Start to investigate the VoltJockey.
September 2017: In collaboration with the University of Maryland.
April 12, 2018: Verifiy VoltJockey attack on ARM TrustZone.
February 2019: Submit a research paper to IEEE S&P.
March 20, 2019: Verify VoltJockey attack on Intel SGX.
May 6, 2019: Demonstrate the VoltJockey on HOST.
May 14, 2019: Submit a research paper about breaking TrustZone to ACM CCS.
June 2019: Submit a research paper about breaking SGX to AsianHost.
November 11, 2019: CCS publishes the paper of VoltJockey.
December 10, 2019: Intel confirm and publish the VoltJockey.
December 16, 2019: AsianHost publishes the VoltJockey.
VoltJockey is an innovative software-controlled hardware fault-based attack on multi-core processors that adopt the dynamic voltage and frequency scaling (DVFS) technique for energy efficiency. This attack can obtain ARM TrustZone-guarded credentials, as well as the potential of bypassing the RSA-based verification to load untrusted applications into TrustZone.
By manipulating the voltages rather than the frequencies via the DVFS unit to generate hardware faults on the victim cores, VoltJockey achieves a stealthier and more efficient attack towards the AES key from TrustZone and the RSA-based TrustZone authentication.
Cite:
Qiu P, Wang D, Lyu Y, et al. VoltJockey: Breaching TrustZone by Software-Controlled Voltage Manipulation over Multi-core Frequencies. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2019: 195-209.
Intel software-guard extensions (SGX) allows applications to run in a trusted space (enclave), which provides a highly secure primitive for the running codes and data.
We follow the basic principle for frequency and voltage based fault injection attacks which adjust the frequency or voltage levels deliberately to create hardware faults. And we develop a kernel module to schedule frequency and voltage for Intel processors through model-specific registers (MSR). Finally, we propose the first fault injection attack to break SGX and deploy the proposed attack to extract the key of an AES executed in the SGX enclave.
Cite:
Qiu P, Wang D, Lyu Y, et al. VoltJockey: Breaking SGX by Software-Controlled Voltage-Induced Hardware Faults. Proceedings of the Asian Hardware Oriented Security and Trust Symposium (AsianHOST). 2019.
Infer the key of AES executed in the normal world.
Infer the key of AES executed in the TrustZone.
Change the output of RSA executed in the normal world.
Change the output of RSA executed in the TrustZone.
We have verified the vulnerability on the Qualcomm's APQ8084AB CPU and Intel's i7-8550U CPU. If your processor is a multi-core processor and enables DVFS and the trusted execution environment, you will probably be affected by the vulnerability. We welcome you to report the processors that are affected by the vulnerability.
Intel has assigned a CVE number to the vulnerability, whic is CVE-2019-11157.
It is hard to defend against the vulnerability solely with software. We suggest you to well protect your account and password.
Room 4-305, FIT building, Tsinghua University, Beijing, China.
Email: luyq@mail.tsinghua.edu.cn
Phone: +86 189-1036-3606
Copyright © 2019 Tsinghua University. All rights reserved.