sb-eu logo
Story image

Flaw discovered in Intel chips, allows attackers to steal cloud data

16 Aug 2018

Researchers have discovered another security flaw in Intel security chips – the third one this year after Spectre and Meltdown.

The flaw allows an attacker to steal sensitive information stored on personal computers or third-party clouds. 

According to their research report, Foreshadow has two versions, the original attack designed to extract data from Intel SGX enclaves and a Next-Generation version which affects Virtual Machines (VMs), hypervisors (VMM), operating system (OS) kernel memory, and System Management Mode (SMM) memory.

The flaw was discovered by researchers from the Israel Institute of Technology, University of Michigan, the University of Adelaide, and the Catholic University of Leuven.

The report says that mitigations against Meltdown and Spectre are not effective against Foreshadow and Foreshadow-NG.

On its website, Intel says it has “worked with operating system vendors, equipment manufacturers, and other ecosystem partners to develop platform firmware and software updates that can help protect systems from these methods.”

“This includes the release of updated Intel microprocessor microcode to our customers and partners.”

Affected CPUs

Intel confirmed that Foreshadow affects all SGX-enabled Core processors (Skylake and Kaby Lake), while Atom family processors with SGX support remain unaffected. Intel confirmed that Foreshadow-NG affects the following processes:

·  Intel Core i3/i5/i7/M processor (45nm and 32nm)

·  2nd/3rd/4th/5th/6th/7th/8th generation Intel Core processors

·  Intel Core X-series Processor Family for Intel X99 and X299 platforms

·  Intel Xeon processor 3400/3600/5500/5600/6500/7500 series

·  Intel Xeon Processor E3 v1/v2/v3/v4/v5/v6 Family

·  Intel® Xeon Processor E5 v1/v2/v3/v4 Family

·  Intel® Xeon Processor E7 v1/v2/v3/v4 Family

·  Intel® Xeon Processor Scalable Family

·  Intel® Xeon Processor D (1500, 2100)

Cloud threat defence company RedLock’s Cloud Security VP Matthew Chiodi says, “What’s interesting about the Intel disclosure is that researchers simply followed the thread left by Spectre and Meltdown—this isn’t a completely new class of vulnerabilities.

“This means that while Intel is not officially aware of any exploits that take advantage of this today, certainly advanced nation-states have been working on them.

“Interestingly enough, back in June, the OpenBSD project announced plans to disable support for Intel CPU hyper-threading (HT) due to security concerns around more ‘Spectre-class bugs’ - Their announcement has proved prescient.”

Chiodi adds that public cloud titans Google, Microsoft and AWS quickly responded to Foreshadow by updating their respective infrastructure and services.

“Enterprise cloud consumers tangibly benefited as the vast majority of them are not operating multi-tenant workloads on the same VM.

“That doesn’t mean there’s nothing to do on the end-user side, but the cloud providers have already done a lot of the heavy lifting.

He concludes,” The bottom line is that even the best and fastest fixes aren’t effective unless all stakeholders do their part—this is especially relevant in public cloud given the shared responsibility model.

"It only takes one party, one weak link in the chain, for the exposure to remain.”

Story image
How security awareness training can safeguard companies from cyber-attacks
Training goes a long way in embedding a culture of cybersecurity compliance within the company.More
Story image
Proofpoint launches new SMB focused security awareness training
Proofpoint has launched security awareness training for small to medium businesses (SMBs) with the aim of reducing successful phishing attacks and malware infections to almost zero. More
Story image
Yubico launches latest YubiKey with NFC & USB-C support
Yubico has released a new hardware authentication key, designed to provide security through both near-field communication (NFC) and USB-C connections and smart card support.More
Story image
High-tech heist: why fending off ransomware attacks is more challenging than ever in 2020
The COVID-19 crisis has unleashed a wave of sophisticated and disruptive ransomware attacks, and the onus is on businesses to ramp up their security measures if they’re to avoid falling victim, writes Attivo Networks regional director for A/NZ Jim Cook.More
Story image
Phishing scam imitates SharePoint & OneNote for nefarious clicks
Sophos researchers say that the attackers take a slightly different approach to the standard ‘fake login’ phishing email.More
Story image
Radware issues security alert, warning of global rise of DDoS-for-hire
Efforts from corporations, law enforcement and independent researchers around the world have attempted in the last two years to curb this growth – but the industry keeps growing says Radware information security researcher Daniel Smith.More