Think like hackers to strengthen security

0 93

Subscribe to the newsletter the daily to receive our latest news once a day.
You may also be interested

[EN VIDÉO] What is a cyberattack?
With the development of the Internet and the cloud, cyberattacks are becoming more frequent and sophisticated. Who is behind these attacks and for what purpose? What are the methods of hackers and what are the most massive cyberattacks?

In recent years, many hardware flaws were discovered within processorsforcing manufacturers to review their architecture for subsequent generations, and also to work in particular with Microsoft to set up a workaround directly at the operating system level. However, one of the elements of the processors, which is however connected to all the components on the chip, is rather little studied.

Processors for multicore servers Intel are complex chips, with many elements. Each core is actually a processor in itself, with its own cache memory. The chip also has a common cache for all cores. When one of the cores needs information in the common cache memory, or that of one of the other cores, it must go through the interconnect, a dedicated component to regulate the traffic.

The architecture of the interconnection of processors for Intel servers, on the left the old one, on the right the one used since 2017. © Intel

A sophisticated but very real attack

Until now, cybersecurity researchers have judged any possibility of an attack targeting the interconnection as unlikely because it is too complex. However, researchers from Massachusetts Institute of Technology (MIT) in the United States have just discovered that it is possible to use the Mesh Interconnect Architecture from Intelwhich replaced the previous interconnect (Ring Architecture) in 2017, to steal sensitive data from software such as a password or cryptographic key.

It is by measuring this latency that they manage to extract information from the software running on these cores.

Whenever two cores simultaneously attempt to access information that is not in their own cache memory, the interconnect will have to prioritize one or the other, creating delays. It is by measuring this latency that they manage to extract information from the software running on these cores.

Researchers first had to create programs that intentionally access cache memory located outside the cores on which they run. This allowed them to map the interconnect, and thus create an operating model, and even determine which cores are most vulnerable to side channel attack. They can then steal information bit by bit and have managed to extract the cryptographic keys of two different programs.

An attack that only targets servers?

The good news is that this study focused on Intel server processors that have a different architecture than the computers General public. The same attack should therefore not work on a simple PC where the Mesh Interconnect Architecture is not present. However, if a server is affected, criminals could steal information of a large number of users.

The researchers used their model to find two methods that administrators can put in place to limit the risk of attack. The first is to determine which cores are most exposed to this kind of attack, and to run the most sensitive programs on the less vulnerable cores. The second strategy is to reserve the cores located around the one executing a sensitive program. By only running approved programs on these cores, an intruder will not be able to attempt to monitor the sensitive program.

Subscribe to the newsletter the daily : our latest news of the day. All our newsletters


Thank you for your registration.
Glad to have you among our readers!

Leave A Reply

Your email address will not be published.