3

Intel's new SGX extension is concerning. It allows the programmer to create enclaves in their program where the data is encrypted until it is used. This is apparently supposed to be used for cloud servers; it is uncertain whether the extension will make it to the desktop.

The concerning part is that the instruction set allows for encryption not only of data but of code as well. This would effectively defeat any attempts at reverse engineering a program. Think of the implications of this. Malware detection techniques will no longer work. People who want to reverse engineer code for research or cross-compatibility purposes will no longer be able to. The crackers and the people who want to stifle the free flow of information will have won. Is this really the future we have to look forward to?

EDIT: To narrow the question down, if code uses SGX instructions, how could it be analyzed?

Improve this question
5
  • 3
    Welcome to Security.StackExchange! This question is very interesting, however, it more likely to lead to a discussion than an answer. Can you narrow the scope to a specific question such as "If a malware sample uses SGX, how can a malware analyst inspect the sample?"
    – amccormack
    Commented Dec 10, 2015 at 17:21
  • Thanks for ruining any chances of this question getting any answers. I really appreciate it. I even edited it like you said, and no one's answering.
    – Zen Hacker
    Commented Dec 10, 2015 at 18:19
  • 1
    my comment was intended to help you get answers. Security.StackExchange has guidelines for good questions (which lead to good answers). The question "Is this really the future we look forward to" is not a good question since it leads to opinionated discussion. Editing your question increases the likelihood that someone will answer it, but doesn't guarantee members of the community actually know the answer.
    – amccormack
    Commented Dec 10, 2015 at 18:27
  • Okay. So is the issue that not many people understand SGX since it's such a new technology?
    – Zen Hacker
    Commented Dec 10, 2015 at 18:29
  • 1
    That very well could be the case. You may also want to move this question to reverseengineering.stackexchange.com since the community there is more focused on reverse engineering.
    – amccormack
    Commented Dec 10, 2015 at 18:40

2 Answers 2

Reset to default
6

It is very unlikely that malware authors will be able to SGX. In fact it is very unlikely that most people will be able to use SGX. This is because Intel has implemented strong cryptographic DRM on SGX.

In order to be able to launch an SGX program, it either needs to be signed directly by Intel, or by another local SGX program that is signed by Intel. Intel has not been forthcoming with details about SGX, but it is clear that only “licensed” developers will be able to use it. “To be fully utilized, Intel SGX [requires] additional software capabilities, which will begin to be delivered by the ecosystem later this year.”† “The SGX software stack [...] is being made available on a licensed basis.”‡ “The SDK is not publicly available.”* You can find more information about how the DRM is implemented at https://jbeekman.nl/blog/2015/10/intel-has-full-control-over-sgx/

To answer your narrower question: SGX programs are not encrypted before launch, so it is possible to analyze the code as you would any other binary. However, it is possible for that program to be a small bootstrap program (stage 1) that talks to an external server over the Internet. The external server could send the important code (stage 2) to the stage 1 program after it has verified that the stage 1 program is launched securely. In this case, you won't be able to analyze the stage 2 program.

Also note that--since SGX programs can't make syscalls--in order for Malware to do anything to your system, there needs to be a insecure wrapper program to actually talk to the system. You will be able to analyze this wrapper program using standard techniques.

† http://download.intel.com/newsroom/kits/core/6thgen/pdfs/6th_Gen_Intel_Core-Intel_Xeon_Factsheet.pdf
‡ https://software.intel.com/en-us/forums/intel-isa-extensions/topic/583931
* https://software.intel.com/en-us/forums/intel-trusted-execution-technology-intel-txt/topic/600736

Improve this answer
0
0

According to this patent application, Intel will provide a mechanism for anti-malware software to enter enclaves for inspection.

Improve this answer
1
  • 2
    This answer is a little light on details. Can you explain how the patent applies to the OP's question?
    – schroeder ♦
    Commented Dec 10, 2015 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .