New NetCAT Attack Can Leak Sensitive Data From Intel CPUs

LASER_oneXM · Sep 11, 2019

A weakness named NetCAT (Network Cache ATtack) affects all Intel server-grade processors since 2012 and allows sniffing sensitive details by mounting a side-channel attack over the network.
Researchers from the VUSec group at Vrije Universiteit Amsterdam discovered that information present in the CPU cache on systems with Intel’s Data Direct I/O (DDIO) feature enabled.

Inferring data from SSH sessions

DDIO is specific to Intel server-grade processors and is turned on by default on Intel Xeon E5, E7 and SP families from 2012 onwards.
Its purpose is to share the CPU cache with network devices and peripherals for better performance of server applications in fast networks.

NetCAT is a network-based attack that can be deployed to infer data in the CPU's last-level cache of a remote machine. VUSec researchers showed that an attacker controlling a machine on the network can use this method to infer confidential data from an SSH session without malicious software running on the target system.

upnorth · Sep 11, 2019

NetCAT will go down in history as the first network-based CPU side-channel attack.

DDE_Server · Sep 11, 2019

Unlike previous side-channel vulnerabilities disclosed in Intel CPUs, researchers have discovered a new flaw that can be exploited remotely over the network without requiring an attacker to have physical access or any malware installed on a targeted computer.

Dubbed NetCAT, short for Network Cache ATtack, the new network-based side-channel vulnerability could allow a remote attacker to sniff out sensitive data, such as someone's SSH password, from Intel's CPU cache.

Discovered by a team of security researchers from the Vrije University in Amsterdam, the vulnerability, tracked as CVE-2019-11184, resides in a performance optimization feature called Intel's DDIO—short for Data-Direct I/O—which by design grants network devices and other peripherals access to the CPU cache.

The DDIO comes enabled by default on all Intel server-grade processors since 2012, including Intel Xeon E5, E7 and SP families.

According to the researchers [paper], NetCAT attack works similar to Throwhammer by solely sending specially crafted network packets to a targeted computer that has Remote Direct Memory Access (RDMA) feature enabled.

RDMA enables attackers to spy on remote server-side peripherals such as network cards and observe the timing difference between a network packet that is served from the remote processor's cache versus a packet served from memory.
you can continue reading from here: