Researchers Implant “Protected” Malware On Intel SGX Enclaves

Cybersecurity researchers have discovered a way to hide
malicious code in Intel SGX enclaves, a hardware-based memory
encryption feature in modern processors that isolates sensitive
code and data to protect it from disclosure or modification.

In other words, the technique allows attackers to implant
malware code in a secure memory that uses protection features of
SGX which are otherwise designed to protect important data from
prying eyes or from being tampered, even on a compromised
system.

Introduced with Intel’s Skylake processors, SGX (Software Guard
Extensions) allows developers to run selected application modules
in a completely isolated secure region of memory, called enclaves,
which are designed to be protected from processes running at higher
privilege levels like the operating system, kernel, BIOS, SMM,
hypervisor, etc.

However, a team of researchers, some of whom were behind the
discovery of the Spectre-Meltdown
CPU flaws, managed to bypass this protection and got their own
malicious application in the secure enclaves by leveraging the
age-old technique of return-oriented programming (ROP).

The attack also uses Transactional Synchronization eXtensions
(TSX), found in
modern Intel CPUs, in conjunction with a novel fault-resistant read
primitive technique called TSX-based Address Probing (TAP).
^[2]

TAP uses TSX to determine if a virtual address is accessible by the
current process, and this exploration of memory is undetectable
because operating system-level applications cannot look inside an
enclave, by design.

To determine whether a memory page is writable, the team developed
a fault-resistant write primitive, Checking Located Addresses for
Writability (CLAW), which encapsulates the write instruction for
the target memory page within a TSX transaction and explicitly
aborts the transaction after the write.

After that, the writability of the target memory page can be
deduced based on the return value of the transaction.

Once the malware gets its way into the secure enclave, the
confidentiality and integrity that SGX fundamentally guarantees to
legit programs would also prohibit researchers or security
solutions from detecting and analyzing the malware within an
enclave.

This would eventually allow the malware app to bypass various
security technologies, such as operating system-level Address Space
Layout Randomization (ASLR), stack canaries, and address sanitizer,
as well as execute arbitrary code on the targeted system.

The researchers said the proof-of-concept exploit developed by
their team bypassed ASLR, stack canaries, and address sanitizer, to
“run ROP gadgets in the host context enabling practical enclave
malware,” noting that the entire exploit process took 20.8 seconds.

In the end, the academics concluded that instead of “protecting
users from harm, SGX currently poses a security threat,
facilitating so-called super-malware with ready-to-hit
exploits.”

The mitigations against such attacks could be implemented in
future generations of Intel CPUs that better sandbox the SGX
enclaves. While some of those mitigations would require
hardware-level changes without costing any performance, some would
not require hardware modifications but would trade some
performance.

^[1][4]