Lowyat.NET: Latest topics by ZM Fong

PSA: Do not update BIOS with Plundervolt patch

ZM Fong — Sat, 15 Feb 2020 00:01:58 +0800

QUOTE

Academics from three universities across Europe have disclosed today a new attack that impacts the integrity of data stored inside Intel SGX, a highly-secured area of Intel CPUs.

The attack, which researchers have named Plundervolt, exploits the interface through which an operating system can control an Intel processor's voltage and frequency -- the same interface that allows gamers to overclock their CPUs.

Academics say they discovered that by tinkering with the amount of voltage and frequency a CPU receives, they can alter bits inside SGX to cause errors that can be exploited at a later point after the data has left the security of the SGX enclave.

They say Plundervolt can be used to recover encryption keys or introduce bugs in previously secure software.

HOW THE PLUNDERVOLT ATTACK WORKS
The Plundervolt attack specifically targets Intel Software Guard eXtensions (SGX).

Intel SGX is a very powerful security feature found in all modern Intel CPUs. It allows developers to isolate applications in secure "enclaves" where they can trust the CPU with sensitive information, knowing the data is safe from other apps running on the OS.

SGX enclaves run on small sections of the main Intel CPU memory and are usually isolated at a hardware level (the SGX memory is separate from the rest of the CPU memory) and at a software level (SGX data is encrypted).

Earlier this year, a team of six academics from the University of Birmingham (UK), KU Leuven (Belgium), and the Graz University of Technology (Austria) have realized that they can combine the concepts behind two other past attacks to attack data inside Intel SGX.

The first was the Rowhammer attack, which showed that when you tinker with a memory cell's electrical charge, you can cause it to flip its bit value from 1 to 0, and vice versa.

The second was CLKSCREW, which showed how you could use a CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a computer.

Plundervolt combines the principles behind these two attacks. It uses the CPU's energy management interface to alter electrical voltage and frequency inside the SGX memory cells, causing unwanted alterations to SGX data.

These are small alterations, though, and do not break SGX secrecy. Instead, they introduce bugs and faults inside the SGX operations and the data they handle. In other words, Plundervolt doesn't break SGX, but merely sabotages its output.

For example, Plundervolt can be used to induce bugs in the encryption algorithms/operations performed inside SGX, resulting in encrypted content that's easy to crack once it leaves the SGX enclave, allowing attackers to recover the encryption key that was used to encrypt the data in the first place.

Plundervolt is a serious issue. The research team said it notified Intel in June, and the vendor has worked tirelessly to prepare patches.

Microcode and BIOS updates were released today as part of security advisory INTEL-SA-00289. These updates give administrators a new BIOS option to disable the volting and frequency control interface on their systems, if they don't use it, or if they perceive Plundervolt (CVE-2019-11157) to be a real risk.

According to Intel, the following CPU series are vulnerable to Plundervolt attacks:

Intel® 6th, 7th, 8 th, 9th & 10th generation CoreTM processors
Intel® Xeon® Processor E3 v5 & v6
Intel® Xeon® Processor E-2100 & E-2200 families
Plundervolt is nothing that end-users should worry about. It's an attack vector that is of little interest for malware authors since it's hard to automate at scale. It is, however, an attack vector that could be weaponized in targeted attacks, against specially selected targets. If Plundervolt is a serious threat depends on each user's threat matrix.

A research paper describing the Plundervolt attack can be downloaded from this website. The paper is entitled "Plundervolt: Software-based Fault Injection Attacks against Intel SGX."

TL;DR: If you wish to keep undervolting feature in your Intel based laptops, do not update BIOS with Plundervolt patch (CVE-2019-11157). Many HP laptops have newer BIOS with undervolting disabled from what I know so far

Further reading:
https://plundervolt.com/
https://www.zdnet.com/article/new-plundervo...cts-intel-cpus/
https://www.tomshardware.com/news/plundervo...king-mechanisms
https://www.techpowerup.com/262024/new-plun...-protected-data
http://forum.notebookreview.com/threads/bl...te-bios.831450/
http://forum.notebookreview.com/threads/pl...ecurity.831309/

Manufacturer websites for this patch:
https://support.lenovo.com/us/en/product_security/LEN-29846
https://support.hp.com/my-en/document/c06502052
https://www.dell.com/support/article/my/en/...a-00317?lang=en

Time to go AMD perhaps?

Direct links to all my laptop reviews

ZM Fong — Fri, 13 Sep 2019 19:49:02 +0800

Decided to open a new thread to store all direct links of my reviews for convenience. Also my signature wouldn't look messy

This thread will be updated time to time, sorted from newest to oldest

Level51 Forge 15R
https://genexisx.blogspot.com/2020/06/quick...5r-r5-3600.html

Illegear Onyx Pro
https://genexisx.blogspot.com/2020/01/revie...o-i7-9750h.html

Level51 Vapor 15 Pro
https://genexisx.blogspot.com/2020/01/revie...o-i7-9750h.html

Illegear Laguna SE
https://genexisx.blogspot.com/2019/10/revie...-9750h-rtx.html

Level51 Nova 15
https://genexisx.blogspot.com/2019/09/revie...h-rtx-2070.html

Illegear Raven SE-R
https://linustechtips.com/main/topic/110193...9750h-rtx-2060/

Commandos Glock 5 Plus
https://linustechtips.com/main/topic/109612...400-gtx-1660ti/

Lenovo Ideapad S540-14API
https://linustechtips.com/main/topic/107102...5-3500u-vega-8/

Illegear Raven SE
https://forum.lowyat.net/index.php?showtopi...post&p=92489781

Illegear Rogue
https://forum.lowyat.net/index.php?showtopi...post&p=92489781

Illegear Prodigy
https://forum.lowyat.net/index.php?showtopi...post&p=92489781

Level51 Forge 15 Pro
https://forum.lowyat.net/index.php?showtopi...post&p=92419429

Level51 Forge 15
https://forum.lowyat.net/index.php?showtopi...post&p=92419429

Level51 Slate-15, Slate-17
https://forum.lowyat.net/index.php?showtopi...post&p=92419429

Illegear Onyx
https://forum.lowyat.net/index.php?showtopi...post&p=92489781

Illegear Selenite
https://forum.lowyat.net/index.php?showtopi...post&p=92489781

Commandos Glock 5
https://linustechtips.com/main/topic/101375...400-gtx-1050ti/

Illegear Raven
https://forum.lowyat.net/index.php?showtopi...post&p=92489784

Acer Aspire 5 A515-51G
https://linustechtips.com/main/topic/897726...i5-8250u-mx150/

Lenovo Legion Y520
https://linustechtips.com/main/topic/753580...q-gtx-1050-2gb/

Gaming laptops approval list

ZM Fong — Fri, 26 Apr 2019 18:36:37 +0800

Updated: 9 March 2022 - Will update again when there are a few decent ADL/Rembrandt models available

Here are all the decent gaming laptops you can buy.

How I rate gaming laptops: Thermals and performance first, followed by build quality

A few notes before reading: