Intel and AMD chips have another serious security flaw to worry about

Date:
Wed, 15 Jun 2022 14:09:04 +0000

Description:
Researchers believe AMD and Intel hardware could be targeted to steal cryptographic keys and other data.

FULL STORY ======================================================================

Chips from Intel and AMD, as well as processors from other manufacturers, may be susceptible to a new type of attack which could allow threat actors to steal cryptographic keys and other data directly from the endpoint's
hardware.

A team of security researchers, including Riccardo Paccagnella of the University of Illinois Urbana-Champaign, set out to investigate the idea of extracting cryptographic data from a chip by measuring the power consumed during data processing. Its a relatively old theory thats been proven
inviable in practice, due to the inability to measure power consumption remotely.

But the researchers managed to give the idea a new twist, by turning the attack into a different type of side-channel exploit, and this one is a lot more viable.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 . Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/10.99. Intel plays down the flaw

As it turns out, through dynamic voltage and frequency scaling (DVFS), attackers can track the time the server takes to respond to specific queries, effectively allowing them to spot changes in power consumption. Its a relatively simple thing, researchers said. Theyve dubbed the vulnerability Hertzbleed, and its since being tracked as CVE-2022-24436 for Intel devices, and CVE-2022-23823 for AMD.

While they managed to successfully reproduce the attack on Intel chips from 8th to 11th generation, theyre also saying it works on Xeon, as well as Ryzen chips.

But Intel is having none of it. Responding to the findings, the companys Senior Director of Security Communications and Incident Response Jerry
Bryant, wrote that the idea is not practical outside the lab. Read more

Spectre returns - Intel and ARM-based CPUs hit by serious vulnerability

Keeping your CPU safe from Spectre imposes serious performance penalty

New Meltdown and Spectre exploits have been built, but arent in the wild

yet

"While this issue is interesting from a research perspective, we do not believe this attack to be practical outside of a lab environment. Also note that cryptographic implementations that are hardened against power side-channel attacks are not vulnerable to this issue.

The chip manufacturers wont be updating their chips, Ars Technica found, and will instead endorse changes Microsoft and Cloudflare made to their PQCrypto-SIDH and CIRCL cryptographic code libraries.

Via: Ars Technica



======================================================================
Link to news story: https://www.techradar.com/news/intel-and-amd-chips-have-another-serious-securi ty-flaw-to-worry-about/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)