Hacking in Darkness: Return-oriented Programming against Secure Enclaves

By Jae-Hyuk Lee, Jinsoo Jang, Yeongjin Jang, Nohyun Kwak, Yeseul Choi, Changho Choi, Taesoo Kim, Marcus Peinado, Brent Byunghoon Kang. 2017

195 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

1. Michael Schwarz
2. Raymond Cheng
3. Moritz Lipp
4. Jo Van Bulck
5. Fan Zhang
6. Kit Murdock
7. Daniel Gruss
8. Warren He

Citations in the corpus

• Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts (2018, positive): “Although trusted hardware aims to protect confidentiality for TEE, recent work has uncovered data leakage via side-channel attacks [18, 38, 40, 46, 53, 54, 66, 70, 79, 91, 93].”
• POSTER: Rust SGX SDK: Towards Memory Safety in Intel SGX Enclave (2017, background): “However, SGX enclaves could have memory corruption vulnerabilities and could be exploited and hi-jacked [9, 12] and thus secrets would be leaked in such attacks.”
• Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, background): “…work on dismantling SGX’s confidentiality guarantees [69, 11, 46, 73, 50, 25, 72] as well as exploiting classical memory safety vulnerabilities in enclaves [45, 8, 70], Plundervolt represents the first attack that directly violates SGX’s integrity guarantees for functionally correct enclave software.”
• Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution (2018, unknown): “Existing attacks either exploit low-level memory safety vulnerabilities [38, 59], or abuse application-specific information leakage from side-channels.”
• On Security Analysis of Proof-of-Elapsed-Time (PoET) (2017, background): “Indeed, they may be vulnerable to sophisticated adversaries [18,23].”
• ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, background): “r the local enclave identity report. Schwarz et al. Over the past years, researchers have demonstrated various attacks to leak sensitive data from SGX enclaves, e.g., through memory safety violations [44], race conditions [74], or side-channels [54, 63, 70, 71]. More recently, SGX was also compromis”
• SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, background): “Further, researchers have shown that it is possible to attack enclaves with software vulnerabilities [23, 35].”