New flaw in Intel chips lets attackers slip their own data into secure enclave

Re:New flaw in Intel chips lets attackers slip their own dat... by gowld on Tuesday March 10, 2020 @02:25PM (#22538045)

Not really, because if your device is owned, they can read your credit card info from the main OS environment. Secure enclave us really about protecting the device from being stolen and taken over, not protecting important secrets.

An attacker doesn't want to remotely steal your iPhone or laptop. At most they want to unlock it after they steal the physical device.

Injecting a bios worm into a data center is more of a concern.

[ Parent | on HN ]

Re:New flaw in Intel chips lets attackers slip their own dat... by sulam on Tuesday March 10, 2020 @02:36PM (#22538157)

This is actually not accurate. The payments loop is entirely closed in an SE-based system. There are keys loaded on the enclave in manufacturing that come from the card networks, they encrypt tokens on the way to the SE and they can only be decrypted on the SE itself. Then during an actual transaction there is another encrypted exchange over RFID and again the encrypted blob is generated by an applet on the SE.

[ Parent | on HN ]

Re:New flaw in Intel chips lets attackers slip their own dat... by paulmd on Tuesday March 10, 2020 @03:05PM (#22538480)

Sure, that's the theory, but I'm not sure a "SE-based" system as you describe it is actually used at all, or certainly for any non-trivial volume of transactions, in an Intel-based (desktop/laptop) environment.

I've never used a web store checkout system that wasn't based on browser forms, or any mechanism that felt like asking a secure enclave to sign a transaction. Google Chrome offers to store your credit card numbers for you, but that's just so it can autofill web forms.

Apple Pay or whatever, sure, on their hardware. Macbooks, I'd think it uses the touchbar secure enclave. But nothing really uses SGX on Intel except Netflix DRM.

[ Parent | on HN ]