{"id":4289,"date":"2020-10-22T16:59:39","date_gmt":"2020-10-22T08:14:39","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=4289"},"modified":"2020-10-22T16:59:39","modified_gmt":"2020-10-22T08:14:39","slug":"%e3%80%90asplos-2020%e8%ae%ba%e6%96%87%e8%a7%a3%e8%af%bb%e3%80%91%e7%99%be%e5%ba%a6%e7%a0%94%e7%a9%b6%e9%99%a2%e5%ae%89%e5%85%a8%e7%a7%91%e5%ad%a6%e5%ae%b6%e7%a8%8b%e8%b6%8a%e5%bc%ba%ef%bc%9acoin-atta","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=4289","title":{"rendered":"\u3010ASPLOS 2020\u8bba\u6587\u89e3\u8bfb\u3011\u767e\u5ea6\u7814\u7a76\u9662\u5b89\u5168\u79d1\u5b66\u5bb6\u7a0b\u8d8a\u5f3a\uff1aCOIN Attacks-On Insecurity of Enclave Untrusted Interfaces in SGX"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\u57282020\u5e748\u670812\u65e5\u4e3e\u529e\u7684\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\u4f1a \uff08\u4e0b\uff09 \u4e0a \uff0c\u6765\u81ea\u767e\u5ea6\u7814\u7a76\u9662(\u5317\u7f8e)\u5b89\u5168\u79d1\u5b66\u5bb6\u7684\u7a0b\u8d8a\u5f3a\uff0c\u5206\u4eab\u4e86\u4ed6\u4eec\u53d1\u8868\u5728ASPLOS 2020\u4e0a\u7684\u6700\u65b0\u7814\u7a76\u6210\u679c\u300aCOIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX\u300b\u3002 \u8fd9\u7bc7\u8bba\u6587\u9610\u8ff0\u4e86\u5b58\u5728\u4e00\u79cdIntel SGX Enclave\u7684\u8f6f\u4ef6\u63a5\u53e3\u98ce\u9669\uff0c\u5e76\u63d0\u51fa\u4e86\u4e00\u7ec4\u9488\u5bf9Intel SGX\u8f6f\u4ef6\u7684\u65b0\u578b\u653b\u51fb \u2013 COIN Attacks\u3002 <\/p>\n\n\n\n<iframe id=\"video\" src=\"\/\/player.bilibili.com\/player.html?aid=927422799&#038;bvid=BV1uT4y1w7Rm&#038;cid=247236681&#038;page=1\" style=\"width:96%\" height=498 width=510 frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe>\n<script>\nvd = document.getElementById(\"shipin\");\nif (vd != null) {\n    vd.style.height = vd.scrollWidth*0.8+\"px\";\n}\n<\/script>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898\uff1aCOIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Intel SGX is a hardware-based trusted execution environment (TEE), which enables an application to compute on confidential data in a secure enclave. SGX assumes a powerful threat model, in which only the CPU itself is trusted; anything else is untrusted, including the memory, firmware, system software, etc. An enclave interacts with its host application through an exposed, enclave-specific, (usually) bi-directional interface. This interface is the main attack surface of the enclave. The attacker can invoke the interface in any order and inputs. It is thus imperative to secure it through careful design and defensive programming.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this work, we systematically analyze the attack models against the enclave untrusted interfaces and summarized them into the COIN attacks \u2014 Concurrent, Order, Inputs, and Nested. Together, these four models allow the attacker to invoke the enclave interface in any order with arbitrary inputs, including from multiple threads. We then build an extensible framework to test an enclave in the presence of COIN attacks with instruction emulation and concolic execution. We evaluated ten popular open-source SGX projects using eight vulnerability detection policies that cover information leaks, control-flow hijackings, and memory vulnerabilities. We found 52 vulnerabilities. In one case, we discovered an information leak that could reliably dump the entire enclave memory by manipulating the inputs. Our evaluation highlights the necessity of extensively testing an enclave before its deployment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7a0b\u8d8a\u5f3a&nbsp;&nbsp;\u767e\u5ea6\u7814\u7a76\u9662\uff08\u5317\u7f8e\uff09<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2020\/08\/1.jpg\" alt=\"\" class=\"wp-image-4129\" width=\"118\" height=\"118\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/1.jpg 472w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/1-150x150.jpg 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/1-300x300.jpg 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/1-200x200.jpg 200w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/1-144x144.jpg 144w\" sizes=\"auto, (max-width: 118px) 100vw, 118px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Yueqiang Cheng is a Senior Staff Security Scientist at Baidu Security Research. His research revolves around building secure systems and software and includes SGX\/SEV security, virtualization security, rowhammer security, and hardware security. He has received 2 Best Paper awards and published several high-quality papers in top security conferences and journals, such as ASPLOS, USENIX Security, NDSS, ICSE, IEEE TIFS, and IEEE TDSC, ACM TISSEC.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u57282020\u5e748\u670812\u65e5\u4e3e\u529e\u7684\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\u4f1a \uff08\u4e0b\uff09 \u4e0a \uff0c\u6765\u81ea\u767e\u5ea6\u7814\u7a76\u9662(\u5317\u7f8e)\u5b89\u5168&#8230; <a class=\"continue-reading-link\" href=\"http:\/\/202.112.238.40\/wp\/?p=4289\"> Continue reading <span class=\"meta-nav\">&rarr; <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,9],"tags":[],"class_list":["post-4289","post","type-post","status-publish","format-standard","hentry","category-events","category-9"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4289"}],"version-history":[{"count":2,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4289\/revisions"}],"predecessor-version":[{"id":4291,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4289\/revisions\/4291"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4289"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}