News for hackers. Stuff that matters.

A comment on Malware Uses Obscure Intel CPU Feature to Steal Data and Avoid Firewalls. Parent comment

Re:Malware Uses Obscure Intel CPU Feature to Steal Data and ... by MichaelGG on Saturday June 10, 2017 @01:40AM (#14526296)
I think you might not understand SGX's capability. It's just a compute kernel. So if they're taking data from your system, that's still very visible. And if they are sending data, that's also visible. So, sure, it's handy to hide logic. So the WannaCry thing, you'd be able to see it does DNS queries, but not how it determined a certain outcome based on the inputs. But you can't hide, for instance, a keylogger.
[ Parent | on HN ]
Re:Malware Uses Obscure Intel CPU Feature to Steal Data and ... by SXX on Saturday June 10, 2017 @02:30AM (#14526392)
I perfectly understand what you pointing to, but problem of black box running in every piece of software is massive. Anyone could use it to implement remote backdoor in software and then pretend it's just a DRM that talking with licensing server.

Yeah it's could be detected when it's start to be active, but it's doesn't have to. It's could be idle on PC for years undetected just waiting for remote command, trigger or special payload just for you.

PS: Also fact that secure enclave itself can't access system API mean nothing because half of software already have interpreters in it as well as frameworks for every possible activity bad or good.

[ Parent | on HN ]
Re:Malware Uses Obscure Intel CPU Feature to Steal Data and ... by johncolanduoni on Saturday June 10, 2017 @05:21AM (#14526719)
It's not a black box. SGX code is unencrypted even at runtime, and as long as its running that code has to remain present and unencrypted. You can detect it at any time, not just when it starts up.
[ Parent | on HN ]
Re:Malware Uses Obscure Intel CPU Feature to Steal Data and ... by SXX on Tuesday June 13, 2017 @03:17AM (#14543323)
A bit too late response, but anyway. There is already apps that use SGX to safely work with DRM or private keys. If there is a way keep keys secret what would stop anyone from implementing interpreters that will keep code secret?
[ Parent | on HN ]