NetCAT: New Attack Lets Hackers Remotely Steal Data From Intel CPUs

Unlike previous side-channel vulnerabilities disclosed in
Intel CPUs, researchers have discovered a new flaw that can be
exploited remotely over the network without requiring an attacker
to have physical access or any malware installed on a targeted
computer.

Dubbed NetCAT, short for Network Cache ATtack, the new
network-based side-channel
vulnerability^[1]
could allow a remote attacker to sniff out sensitive data, such as
someone’s SSH password, from Intel’s CPU cache.

Discovered by a team of security researchers from the Vrije
University in Amsterdam, the vulnerability, tracked as
CVE-2019-11184, resides in a performance optimization feature
called Intel’s DDIO—short for Data-Direct I/O—which by design
grants network devices and other peripherals access to the CPU
cache.

The DDIO comes enabled by default on all Intel server-grade
processors since 2012, including Intel Xeon E5, E7 and SP families.

According to the researchers [paper^[2]], NetCAT attack works
similar to Throwhammer^[3]
by solely sending specially crafted network packets to a targeted
computer that has Remote Direct Memory Access (RDMA) feature
enabled.

RDMA enables attackers to spy on remote server-side peripherals
such as network cards and observe the timing difference between a
network packet that is served from the remote processor’s cache
versus a packet served from memory.

Here the idea is to perform a keystroke timing analysis to recover
words typed by a victim using a machine learning algorithm against
the time information.

“Compared to a native local attacker, NetCAT’s attack from across
the network only reduces the accuracy of the discovered keystrokes
on average by 11.7% by discovering inter-arrival of SSH packets
with a true positive rate of 85%.”
The VUSec team has also published a video, as shown above,
demonstrating a method for spying on SSH sessions in real-time with
nothing but a shared server.

NetCAT becomes the new side-channel
vulnerability^[5]
joined the list of other dangerous side-channel vulnerabilities
discovered in the past year, including Meltdown and
Spectre^[6], TLBleed^[7], Foreshadow^[8],  SWAPGS^[9], and PortSmash^[10].

In its advisory, Intel has acknowledged the issue and
recommended users to either completely disable DDIO or at least
RDMA to make such attacks more difficult, or otherwise suggested to
limit direct access to the servers from untrusted networks.

The company assigned the NetCAT vulnerability a “low” severity
rating, describing it as a partial information disclosure issue,
and awarded a bounty to the VUSec team for the responsible
disclosure.