Abstract:The ongoing trend of moving data and computation to the cloud is met with concerns regarding privacy and protection of intellectual property. Cloud Service Providers (CSP) must be fully trusted to not tamper with or disclose processed data, hampering adoption of cloud services for many sensitive or critical applications. As a result, CSPs and CPU manufacturers are rushing to find solutions for secure outsourced computation in the Cloud. While enclaves, like Intel SGX, are strongly limited in terms of throughput and size, AMD's Secure Encrypted Virtualization (SEV) offers hardware support for transparently protecting code and data of entire VMs, thus removing the performance, memory and software adaption barriers of enclaves. Through attestation of boot code integrity and means for securely transferring secrets into an encrypted VM, CSPs are effectively removed from the list of trusted entities. There have been several attacks on the security of SEV, by abusing I/O channels to encrypt and decrypt data, or by moving encrypted code blocks at runtime. Yet, none of these attacks have targeted the attestation protocol, the core of the secure computing environment created by SEV. We show that the current attestation mechanism of Zen 1 and Zen 2 architectures has a significant flaw, allowing us to manipulate the loaded code without affecting the attestation outcome. An attacker may abuse this weakness to inject arbitrary code at startup -- and thus take control over the entire VM execution, without any indication to the VM's owner. Our attack primitives allow the attacker to do extensive modifications to the bootloader and the operating system, like injecting spy code or extracting secret data. We present a full end-to-end attack, from the initial exploit to leaking the key of the encrypted disk image during boot, giving the attacker unthrottled access to all of the VM's persistent data.

Attestation Mechanisms for Trusted Execution Environments Demystified

undeSErVed trust: Exploiting Permutation-Agnostic Remote Attestation

Remote Attestation on Program Execution

Remote Attestation on Function Execution

Remote attestation on function execution (work-in-progress)

Secure Remote Attestation with Strong Key Insulation Guarantees

Remote Credential Management with Mutual Attestation for Trusted Execution Environments

Partial Attestation: Towards Cost-Effective and Privacy-Preserving Remote Attestations

Trusted isolation environment: an attestation architecture with usage control model

Scalable Attestation of Virtualized Execution Environments in Hybrid- and Multi-Cloud

End-to-End Security for Distributed Event-Driven Enclave Applications on Heterogeneous TEEs

Attestation Waves: Platform Trust via Remote Power Analysis

A Holistic Approach for Trustworthy Distributed Systems with WebAssembly and TEEs

SNPGuard: Remote Attestation of SEV-SNP VMs Using Open Source Tools

Scanclave: Verifying Application Runtime Integrity in Untrusted Environments

A Design and Verification Methodology for a TrustZone Trusted Execution Environment

DNAttest: Digital-twin-based Non-intrusive Attestation under Transient Uncertainty.

Teamwork Makes TEE Work: Open and Resilient Remote Attestation on Decentralized Trust

Formal Verification of Virtualization-Based Trusted Execution Environments

Ethemba Trusted Host EnvironmentMainly Based on Attestation

Runtime Verification for Trustworthy Computing