It’s not obvious to me that credit card tokens are fungible enough (or stored in SGX). They’re also a highly insured asset with manageable counterparty risk.

Edit: So yeah, I'm not sure it's worth all of the complexity of an SGX attack. There are probably easier ways to get the credit cards.

Credit cards with complete billing info sell for what... 50 cents a piece? If you're rooting a payment processor, maybe a worthwhile target, although you could probably do much better than steal card numbers. A consumer device? Not so much.

I've usually seen them on onion markets for around $5 for those without any guaranteed available balance. Not that I've bought one or ever would.

Most of the real sales are on carder forums. https://krebsonsecurity.com/ writes in-depth from infiltrating some of them if you're curious

Interesting. I haven't looked in a long time, but my vague recollection is of bulk card data being sold much cheaper than that. I could be totally incorrect though!

I mean, you'd expect verified data to sell for more than unvetted bulk dumps, yeah?

Is that really the case? If I'm not mistaken, secure enclaves have a different security model than the use cases you're suggesting: They are so a third party can run software on a user's machine without trusting the user. For example, delivering encrypted drm software to a customer that might be trying to crack it.

It's so you can run software without trusting the operating system. And by extension that implies the root user as well, but that's not always the use case (it is for DRM).

E.g. you might want your credit card processing in an enclave even if it's your own card, simply to hide it from any rootkits or malware you may have installed.

For the user, there is no real point to such a separation. If the system is full of rootkits and malware, the credit card can be hijacked through for the browser, for example. You don't need to get at the actual credit card processing if you can control all inputs and outputs.

Not really, because if your device is owned, they can read your credit card info from the main OS environment. Secure enclave us really about protecting the device from being stolen and taken over, not protecting important secrets.

An attacker doesn't want to remotely steal your iPhone or laptop. At most they want to unlock it after they steal the physical device.

Injecting a bios worm into a data center is more of a concern.

This is actually not accurate. The payments loop is entirely closed in an SE-based system. There are keys loaded on the enclave in manufacturing that come from the card networks, they encrypt tokens on the way to the SE and they can only be decrypted on the SE itself. Then during an actual transaction there is another encrypted exchange over RFID and again the encrypted blob is generated by an applet on the SE.

Sure, that's the theory, but I'm not sure a "SE-based" system as you describe it is actually used at all, or certainly for any non-trivial volume of transactions, in an Intel-based (desktop/laptop) environment.

I've never used a web store checkout system that wasn't based on browser forms, or any mechanism that felt like asking a secure enclave to sign a transaction. Google Chrome offers to store your credit card numbers for you, but that's just so it can autofill web forms.

Apple Pay or whatever, sure, on their hardware. Macbooks, I'd think it uses the touchbar secure enclave. But nothing really uses SGX on Intel except Netflix DRM.