在2020年8月12日举办的网络空间安全国际学术成果分享会 （下） 上 ，来自百度研究院(北美)安全科学家的程越强，分享了他们发表在ASPLOS 2020上的最新研究成果《COIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX》。 这篇论文阐述了存在一种Intel SGX Enclave的软件接口风险，并提出了一组针对Intel SGX软件的新型攻击 – COIN Attacks。
演讲主题：COIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX
内容摘要：
Intel SGX is a hardware-based trusted execution environment (TEE), which enables an application to compute on confidential data in a secure enclave. SGX assumes a powerful threat model, in which only the CPU itself is trusted; anything else is untrusted, including the memory, firmware, system software, etc. An enclave interacts with its host application through an exposed, enclave-specific, (usually) bi-directional interface. This interface is the main attack surface of the enclave. The attacker can invoke the interface in any order and inputs. It is thus imperative to secure it through careful design and defensive programming.
In this work, we systematically analyze the attack models against the enclave untrusted interfaces and summarized them into the COIN attacks — Concurrent, Order, Inputs, and Nested. Together, these four models allow the attacker to invoke the enclave interface in any order with arbitrary inputs, including from multiple threads. We then build an extensible framework to test an enclave in the presence of COIN attacks with instruction emulation and concolic execution. We evaluated ten popular open-source SGX projects using eight vulnerability detection policies that cover information leaks, control-flow hijackings, and memory vulnerabilities. We found 52 vulnerabilities. In one case, we discovered an information leak that could reliably dump the entire enclave memory by manipulating the inputs. Our evaluation highlights the necessity of extensively testing an enclave before its deployment.
嘉宾简介：
程越强 百度研究院（北美）
Yueqiang Cheng is a Senior Staff Security Scientist at Baidu Security Research. His research revolves around building secure systems and software and includes SGX/SEV security, virtualization security, rowhammer security, and hardware security. He has received 2 Best Paper awards and published several high-quality papers in top security conferences and journals, such as ASPLOS, USENIX Security, NDSS, ICSE, IEEE TIFS, and IEEE TDSC, ACM TISSEC.
