https://arstechnica.com/information-technology/2019/09/weakness-in-intel-chips-lets-researchers-steal-encrypted-ssh-keystrokes/
By Dan Goodin
Ars Technica
September 10, 2019
In late 2011, Intel introduced a performance enhancement to its line of server
processors that allowed network cards and other peripherals to connect directly
to a CPU's last-level cache, rather than following the standard (and
significantly longer) path through the server's main memory. By avoiding system
memory, Intel's DDIO—short for Data-Direct I/O—increased input/output bandwidth
and reduced latency and power consumption.
Now, researchers are warning that, in certain scenarios, attackers can abuse
DDIO to obtain keystrokes and possibly other types of sensitive data that flow
through the memory of vulnerable servers. The most serious form of attack can
take place in data centers and cloud environments that have both DDIO and
remote direct memory access enabled to allow servers to exchange data. A server
leased by a malicious hacker could abuse the vulnerability to attack other
customers. To prove their point, the researchers devised an attack that allows
a server to steal keystrokes typed into the protected SSH (or secure shell
session) established between another server and an application server.
Merely scratching the surface
The researchers have named their attack NetCAT, short for Network Cache ATtack.
Their research is prompting an advisory for Intel that effectively recommends
turning off either DDIO or RDMA in untrusted networks. The researchers say
future attacks may be able to steal other types of data, possibly even when
RDMA isn't enabled. They are also advising hardware makers do a better job of
securing microarchitectural enhancements before putting them into billions of
real-world servers.
"While NetCAT is powerful even with only minimal assumptions, we believe that
we have merely scratched the surface of possibilities for network-based cache
attacks, and we expect similar attacks based on NetCAT in the future," the
researchers, from the Vrije Universiteit Amsterdam and ETH Zurich, wrote in a
paper published on Tuesday. "We hope that our efforts caution processor vendors
against exposing microarchitectural elements to peripherals without a thorough
security design to prevent abuse."
[...]
--
Subscribe to InfoSec News
https://www.infosecnews.org/subscribe-to-infosec-news/
https://twitter.com/infosecnews_
