sb-au logo
Story image

Flaw discovered in Intel chips, allows attackers to steal cloud data

16 Aug 2018

Researchers have discovered another security flaw in Intel security chips – the third one this year after Spectre and Meltdown.

The flaw allows an attacker to steal sensitive information stored on personal computers or third-party clouds. 

According to their research report, Foreshadow has two versions, the original attack designed to extract data from Intel SGX enclaves and a Next-Generation version which affects Virtual Machines (VMs), hypervisors (VMM), operating system (OS) kernel memory, and System Management Mode (SMM) memory.

The flaw was discovered by researchers from the Israel Institute of Technology, University of Michigan, the University of Adelaide, and the Catholic University of Leuven.

The report says that mitigations against Meltdown and Spectre are not effective against Foreshadow and Foreshadow-NG.

On its website, Intel says it has “worked with operating system vendors, equipment manufacturers, and other ecosystem partners to develop platform firmware and software updates that can help protect systems from these methods.”

“This includes the release of updated Intel microprocessor microcode to our customers and partners.”

Affected CPUs

Intel confirmed that Foreshadow affects all SGX-enabled Core processors (Skylake and Kaby Lake), while Atom family processors with SGX support remain unaffected. Intel confirmed that Foreshadow-NG affects the following processes:

·  Intel Core i3/i5/i7/M processor (45nm and 32nm)

·  2nd/3rd/4th/5th/6th/7th/8th generation Intel Core processors

·  Intel Core X-series Processor Family for Intel X99 and X299 platforms

·  Intel Xeon processor 3400/3600/5500/5600/6500/7500 series

·  Intel Xeon Processor E3 v1/v2/v3/v4/v5/v6 Family

·  Intel® Xeon Processor E5 v1/v2/v3/v4 Family

·  Intel® Xeon Processor E7 v1/v2/v3/v4 Family

·  Intel® Xeon Processor Scalable Family

·  Intel® Xeon Processor D (1500, 2100)

Cloud threat defence company RedLock’s Cloud Security VP Matthew Chiodi says, “What’s interesting about the Intel disclosure is that researchers simply followed the thread left by Spectre and Meltdown—this isn’t a completely new class of vulnerabilities.

“This means that while Intel is not officially aware of any exploits that take advantage of this today, certainly advanced nation-states have been working on them.

“Interestingly enough, back in June, the OpenBSD project announced plans to disable support for Intel CPU hyper-threading (HT) due to security concerns around more ‘Spectre-class bugs’ - Their announcement has proved prescient.”

Chiodi adds that public cloud titans Google, Microsoft and AWS quickly responded to Foreshadow by updating their respective infrastructure and services.

“Enterprise cloud consumers tangibly benefited as the vast majority of them are not operating multi-tenant workloads on the same VM.

“That doesn’t mean there’s nothing to do on the end-user side, but the cloud providers have already done a lot of the heavy lifting.

He concludes,” The bottom line is that even the best and fastest fixes aren’t effective unless all stakeholders do their part—this is especially relevant in public cloud given the shared responsibility model.

"It only takes one party, one weak link in the chain, for the exposure to remain.”

Story image
O365 a weak point ripe for exploit, say security professionals
71% of more than 1,000 security professionals have been on the receiving end of a Microsoft 365 account takeover, on average, seven times in the last year alone.More
Link image
Virtual demo: Diagnose network cabling problems with the LinkIQ Cable+Network Tester
If you’re finding it difficult to install access points and cabling, or if you can’t pinpoint an issue with a video camera or end user, the LinkIQ Cable+Network Tester could be exactly what you need. Try a free, fully interactive demo now.More
Story image
FrankieOne to build Westpac's BaaS identity infrastructure
“As Australians continue to look for new and different ways to do their banking, we are excited to be part of the ever-growing BaaS movement with Westpac."More
Story image
Video: 10 Minute IT Jams - Radware VP on the challenges of cloud security
In this interview, Techday speaks to Radware vice president of technologies Yaniv Hoffman, who discusses the primary challenges facing IT organisations in terms of their cloud security apparatus.More
Story image
New wormable Android malware discovered through auto-replies in WhatsApp
Check Point Research has discovered new malware on Google’s Play Store that could spread through WhatsApp messages. More
Story image
Microsoft Exchange breach a wake-up call to ditch the server
"There are owners who still have in-house exchange servers because they are suspicious of the cloud or have concerns about their data sovereignty or don't want to contemplate the capital expenditure. But the warning is clear. Get rid of them."More