Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution

By Jo Van Bulck, Marina Minkin, Ofir Weisse, Daniel Genkin, Baris Kasikci, Frank Piessens, Mark Silberstein, Thomas F. Wenisch, Yuval Yarom, Raoul Strackx. 2018

1,209 citations recorded by the source corpus.

Subfields: ML Systems & Hardware, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In ML Systems & Hardware

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, background): “Moreover, it is challenging for TEEs (especially those operating on shared microprocessors) to fully exclude all types of side channel attacks [391].”
Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, background): “In the past years, many attacks have been proposed, with the goal of undermining privacy of enclave computations (Xu et al., 2015; Brasser et al., 2017; Moghimi et al., 2017; Götzfried et al., 2017; Van Bulck et al., 2017; Lee et al., 2017).”
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims (2020, background): “Despite the fact that researchers have been able to find ways to invalidate these underlying assumptions in some cases, and thus invalidate the high-level security claims [110] [111], these mechanisms help to focus defensive efforts and assure users that relatively extreme measures would be required”
SGX-LKL: Securing the Host OS Interface for Trusted Execution (2019, background): “Spectre [61], Foreshadow [98] and Zombieload [85], are implementation-specific and orthogonal to our work.”
HardFails: Insights into Software-Exploitable Hardware Bugs (2019, methodology): “The divide between hardware and software security research is starting to take its toll, as we witness increasingly sophisticated attacks that combine software and hardware bugs to exploit computing platforms at runtime [20, 23, 36, 43, 45, 64, 69, 72, 74].”
Graviton: Trusted Execution Environments on GPUs (2018, background): “Side channels are a serious concern with trusted hardware [10, 12, 22, 38, 45, 50] and building efficient counter measures remains an open problem.”
Fallout: Leaking Data on Meltdown-resistant CPUs (2019, methodology): “3363219 be harmless and valuable performance features, were discovered to have dangerous industry-wide security implications, affecting operating systems [47, 51], browsers [1, 47], virtual machines [78], Intel SGX [74] and cryptographic hardware accelerators [72].”
Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization (2019, background): “2 [54] Read-only Protection Bypass Spectre v5 [59, 66] Ret2Spec and SpecRSB NetSpectre [76] Remote Bounds Check Bypass Foreshadow [87, 95] L1 Terminal Fault”
InvisiSpec: Making Speculative Execution Invisible in the Cache Hierarchy (2018, background): “The Meltdown [2] and L1 Terminal Fault (L1TF) [24], [25] attacks exploit virtual memory-related exceptions.”
A Survey of Distributed Consensus Protocols for Blockchain Networks (2019, background): “Recent attacks such as cache attacks [123], Foreshadow [124] and Foreshadow-NG [125] have demonstrated the ability to extract the EPID private key from hardware exploiting side channels and speculative execution, posing a security threat at the hardware level.”
A new golden age for computer architecture (2019, background): “Two more vulnerabilities in the virtual-machine architecture were subsequently reported.(37,38) One of them, called Foreshadow, allows penetration of the Intel SGX security mechanisms designed to protect the highest risk data (such as encryption keys).”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “Therefore, the combination of the microcode patches and defenses by Intel’s attestation service has been an effective defense against SGXPECTRE Attacks (and also the Foreshadow attack [80]).”
YerbaBuena: Securing Deep Learning Inference Data via Enclave-based Ternary Model Partitioning (2018, neutral): “, Foreshadow[52] and SGXPectre[6], and the”
Foreshadow-NG: Breaking the virtual memory abstraction with transient out-of-order execution (2018, methodology): “• We discuss and analyze three Foreshadow attack variants: Foreshadow-SGX, Foreshadow-OS, and Foreshadow-VMM where the former was identified by us in [9] and the two latter by Intel [5].”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “ers to send their data to an enclave running on a remote servers. In contrast to Shredder, this model still allows the remote server to have access to the raw data and as the new breaches in hardware [1, 2, 61, 62, 63, 64] show, the access can lead to comprised privacy. Differential privacy. As a ma”
ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, methodology): “However, they often impose additional constraints, such as that the data has to be cached in L1 [68, 75], the physical address has to be known [75], or that an attacker can choose only parts of the target address [53].”
Giving State to the Stateless: Augmenting Trustworthy Computation with Ledgers (2019, background): “Although we use SGX, we do not leverage any of these additional features to make sure our implementation matches our model.”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, methodology): “Due to its simplicity and availability, we implemented our prototype on a platform with Intel SGX (yet, the current generation should not be used due to devastating attacks for example [8]).”