Explore the world of speculative execution vulnerabilities in modern CPUs through this in-depth conference talk from HITB CyberWeek. Delve into the RIDL (Rogue In-Flight Data Load) attacks, also known as Microarchitectural Data Sampling (MDS), and learn how they can bypass existing security mitigations. Discover how unprivileged userspace applications can exploit Intel's CPU pipeline to steal sensitive data across security boundaries. Witness practical demonstrations of stealing SGX secrets using JavaScript in a web browser and accessing /etc/shadow from another VM without interacting with the hypervisor. Gain insights from security researchers Stephan van Schaik and Sebastian Österlund as they discuss the implications of these vulnerabilities, existing mitigations, and the challenges of securing modern computer architectures against speculative execution attacks.
Overview
Syllabus
Intro
MDS ATTACKS
Speculative execution attacks
BACKGROUND
FLUSH + RELOAD
SECURITY DOMAINS
Previous Attacks
LEAKY SOURCES
Manuals
Line Fill Buffers?
Experiments
Confused Deputy
Challenges
Filtering Data
Attack scenarios
In-flight data
More examples
Arbitrary kernel leak
Portability
Existing mitigations
RIDL mitigations
Is the attack realistic??
Conclusion
Taught by
Hack In The Box Security Conference
