Intel SGX defenses threatened by novel WireTap intrusion

SecurityWeek reports that Intel Software Guard Extensions, which is integrated into certain Intel CPUs to prevent data and code exposure even in the event of system hacking, could have its DCAP attestation mechanism compromised through the novel WireTap attack that harnesses a passive DIMM interposer.

Using an interposer developed using second-hand electronics enabled deceleration and gathering of DDR4 bus traffic and SGX enclave hijacking before conducting machine attestation key extraction within 45 minutes, according to a study from Georgia Tech and Purdue University researchers.

Threat actors could then leverage the stolen key to infiltrate the confidential smart contract networks Phala and Secret, as well as the centralized blockchain storage system Crust.

Organizations were recommended to counter the WireTap attack threat by curbing deterministic memory encryption, guaranteeing adequate entropy within encryption blocks and signature encryption within the attestation quote, implementing higher bus speeds, and adopting a single master key across SGX enclaves from the same system.