SEVered

Morbitzer, Mathias; Huber, Manuel; Horsch, Julian; Wessel, Sascha

doi:10.1145/3193111.3193112

Cited by 47 publications

(16 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SEVered. The SEVered attack [16] enables a malicious or compromised HV to extract the full memory of SEV-encrypted VMs in plaintext by exploiting SEV's missing integrity protection. SEVered requires a (non-colluding) service in the targeted VM, e.g., a web server, offering a remotely accessible resource.…”

Section: Amd Sev and The Severed Attackmentioning

confidence: 99%

“…Likewise, our attack requires control over the HV, i.e., a malicious administrator or a compromise of the HV. We refer to [16] for further information about SEVered.…”

Section: Amd Sev and The Severed Attackmentioning

confidence: 99%

“…Setup of SEVered. The time required to setup SEVered is evaluated in [16] and is thus not subject of our evaluation. Setting up SEVered usually takes less than 20 seconds, depending on the load of the VM.…”

Section: Performance Indicatorsmentioning

confidence: 99%

“…This allows us to launch the attack from user space by communicating with the KVM kernel module. For page access tracking in KVM we used the technique from [9,16]. While tracking is active, we record all tracked pages in a list in kernel memory.…”

Section: Prototype and Test Setupmentioning

confidence: 99%

“…SEVered [16] is a recent attack on AMD SEV, which showed that it is nevertheless possible for a HV to extract plaintext contents from SEV-encrypted VMs. SEVered exploits SEV's missing integrity protection for VM memory pages, previously discovered by [11,17], to modify the memory mapping of a non-colluding service inside a VM.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Extracting Secrets from Encrypted Virtual Machines

Morbitzer

Huber

Horsch

2019

Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy

Self Cite

View full text Add to dashboard Cite

AMD SEV is a hardware extension for main memory encryption on multi-tenant systems. SEV uses an on-chip coprocessor, the AMD Secure Processor, to transparently encrypt virtual machine memory with individual, ephemeral keys never leaving the coprocessor. The goal is to protect the confidentiality of the tenants' memory from a malicious or compromised hypervisor and from memory attacks, for instance via cold boot or DMA. The SEVered attack has shown that it is nevertheless possible for a hypervisor to extract memory in plaintext from SEV-encrypted virtual machines without access to their encryption keys. However, the encryption impedes traditional virtual machine introspection techniques from locating secrets in memory prior to extraction. This can require the extraction of large amounts of memory to retrieve specific secrets and thus result in a time-consuming, obvious attack. We present an approach that allows a malicious hypervisor quick identification and theft of secrets, such as TLS, SSH or FDE keys, from encrypted virtual machines on current SEV hardware. We first observe activities of a virtual machine from within the hypervisor in order to infer the memory regions most likely to contain the secrets. Then, we systematically extract those memory regions and analyze their contents on-the-fly. This allows for the efficient retrieval of targeted secrets, strongly increasing the chances of a fast, robust and stealthy theft. CCS CONCEPTS• Security and privacy → Virtualization and security.

show abstract

Section: Amd Sev and The Severed Attackmentioning

confidence: 99%

“…Likewise, our attack requires control over the HV, i.e., a malicious administrator or a compromise of the HV. We refer to [16] for further information about SEVered.…”

Section: Amd Sev and The Severed Attackmentioning

confidence: 99%

Section: Performance Indicatorsmentioning

confidence: 99%

Section: Prototype and Test Setupmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations