Chips manufactured by Intel and AMD as well as processors from other manufacturers could be vulnerable to a new kind of attack that could permit attackers to steal cryptographic keys as well as other information directly from the endpoints(opens in a new window) hardware.
A group of security experts comprising Riccardo Paccagnella from the University of Illinois Urbana-Champaign determined to study the possibility of extracting cryptographic information from a chip by analyzing the power consumption in the data processing.
It’s a theory that’s been around for a while that has been proved to be viable through the application of the inability to monitor the power consumption of a device from a distance.
The researchers have managed to give the concept an entirely new twist by changing the attack into an alternative type of side-channel exploit which is more efficient.
Intel minimizes the flaw
As it turns out with Dynamic Voltage and Frequency Scaling (DVFS) attackers are able to observe the time it responds to particular requests, allowing them to identify variations in the power consumption.
It’s an easy thing to do according to researchers. They’ve named the vulnerability Hertzbleed. It’s now being identified as CVE-202-24436 for Intel gadgets, as well as CVE-202-23823 for AMD. AMD.
Although they were able to replicate the attacks on Intel chips from the 8th generation to the eleventh generation, the researchers are affirming that it works on Xeon and Ryzen chips.
However, Intel has no problem with it. Responding to the findings Intel’s Senior Director of Security Communications and Incident Response Jerry Bryant, wrote that the concept isn’t practical outside of the laboratory.
“While this issue is intriguing from a scientific perspective but we do not think this attack is useful outside of a laboratory environment. It is important to note that cryptographic implementations which are protected against power side-channel attacks are not susceptible to this vulnerability.”
The chip makers won’t update their chip, Ars Technica found and instead will be acquiescing to the changes Microsoft and Cloudflare implemented to their PQCrypto-SIDH as well as CIRCL Cryptographic Code Libraries.