Intel's Software Guard exploited to hide Malware

[Ink]

This kind of discovery demonstrates why ongoing security research is so important, as even a major company like Intel can be subject to unseen vulnerabilities.

Intended to help users keep their systems safe and secure, Intel Software Guard Extensions is a set of CPU instructions that can make particular portions of code and data private. However, a new paper suggests that SGX could in fact be used to facilitate a malicious attack.

Samuel Weiser and four collaborators from the Graz University of Technology in Austria have published research that demonstrates how SGX can be used to conceal a piece of malware. Within minutes, this technique was used to gain access to RSA keys hidden in SGX enclaves.

Technical Paper (PDF): https://arxiv.org/pdf/1702.08719.pdf

 

[Winter Soldier]

Interesting article, basically this technique has been used to gain access to RSA keys that are hidden in the SGX enclave.
I use Lenovo computer for my work and I would like to make some personal considerations, without argue the veracity of this article.

Specifically, Lenovo uses two approach: SGX and Authenticate.
The technology used by SGX and Authenticate is an expansion of Intel Active Management Technology (AMT).

Authenticate is the first line of defense protecting the credentials present in the system by an internal locking mechanism in the AMT chip. This means that the credentials are stored in a protected enclave on the hardware itself. A system without the AMT will store the credentials on the hard disk or any other location that is accessible to anyone gaining access to the root.
Authenticate makes available the credentials only when they meet certain criteria, for example, when you can demonstrate by entering a password that your identity is not violated (it is also possible to implement multi-factor authentication, etc.).

SGX is a backup defense, and it comes into play after you have provided the credentials. The reason for this, is that the credentials, despite are communicated to the application, continue to be secure. An attacker that has access to the root or with high privileges to the system, may implement a "man-in-the-middle" attack to steal credentials if they are in use in the application: but not with SGX.
When the credentials are supplied, the CPU generates a secure code within the AMT subsystem that encrypts the portion of the memory dedicated to the application that processes the credentials. In this way, even if the operating system or the application is compromised, the attacker does not have access to the part of the app that is currently processing the credentials, and that is now enclosed in a protected enclave within the memory.

So the full protection is ensured in two ways.

Not only the user must prove its identity because AMT releases the credentials, but the app needs to be performed inside the SGX enclave to demonstrate that it has not been modified by malware.

Then, in order for the attack to be really effective it is necessary to bypass also AMT.