Β© ROOT-NATION.com - Use of content is permitted with a backlink.
A new type of cyberattack is capable of bypassing even the most advanced security mechanisms built into your computer’s processor. There is a microscopic time gap between the procedure for clearing or isolating the chipβs prediction unit and the immediate use of its predictions. Attackers have learned to time their attacks to exploit this narrow window, allowing them to gain access to confidential data.
Read also: AERONAUT β everything that flies above the ground: aviation, UAVs and drones, rockets, and space
The high operating speed of modern computing processors is partly due to their ability to predict future actions. Instead of waiting for the final decision on the programβs execution path, the chip makes an assumption about the most likely scenario and begins processing it in advance. If the prediction is correct, valuable time is saved; if it is incorrect, the results are discarded. However, traces of these calculations remain in the system, and since the discovery of the Spectre vulnerability in 2018, hackers have learned to read these traces to extract confidential data from protected memory areas. For many years, electronics manufacturers and operating system developers have been building defenses against such threats, but a recent study by MITβs Computer Science and Artificial Intelligence Laboratory (CSAIL) proves that a key assumption underlying a significant portion of these defense systems is false.
The basic principle behind existing security solutions is to reset or isolate the chipβs prediction module, which makes it possible to remove any malicious data planted by an attacker. The studyβs authors, Daniel Trujillo and Mengjia Yan, noted that the clearing procedure and the activation of the generated predictions cannot occur absolutely simultaneously. As a result, there is always a time gap, which is sometimes as short as a few instructions. Any process that manages to execute during this pause can re-compromise the prediction system. The researchers have named this category of threats TONTOU.
The researchersβ main achievement lies in developing a reliable method for injecting malicious code directly into this specific time interval. Computer systems regularly suspend their current activity to handle interrupts β small, standard procedures triggered by timers, network activity, or hardware components. Conventional software provides tools for manually configuring such timers. Thanks to ultra-precise timer calibration, Daniel Trujillo and Mengjia Yan were able to force the processor to change its course of action during the least opportune second, causing the interrupt handling process to compromise the system. The proposed method was named INTERRUPT INJECTION.
The research team tested four generations of microprocessors from Intel and AMD and achieved false predictions on hardware from both manufacturers. On Intel devices, the attack successfully bypassed two distinct layers of protection: a software tool designed for older hardware, and protection built directly into the silicon architecture of newer models. Interestingly, the newer protection mechanism held up on one generation of Intel chips but failed on another, indicating significant differences in how engineers implement technologies with the same name.
AMDβs security technology, called Saferet, clears the prediction cache immediately before each access to it, leaving a vulnerability window of just two instructions β which typically execute in a few tens of nanoseconds. However, the researchers were still able to exploit this vulnerability by artificially slowing down the processorβs operation at that specific point, which made the vulnerable section much easier to exploit.
To demonstrate the real-world threat, the researchers developed a fully functional exploit on a computer with an AMD processor running the latest version of the Linux kernel. First, they completely neutralized the protection mechanism that randomly rearranges the operating systemβs layout in memory, succeeding in all 10 attempts, each of which lasted approximately 9 minutes. This made it possible to read from protected memory at a rate of about 5 bytes per second. Although this rate may seem insignificant, it proved sufficient to locate and copy the /etc/shadow file β which contains the root superuserβs password hash β in 50% of the attempts made.
In their research paper, the researchers recommend re-flushing the prediction block immediately after interrupt handling is complete. This approach has proven effective on AMD architectures. At the same time, for Intel, this method may have the opposite effect: since the attack mechanism relies on establishing a stable, rather than a specific, state after an interrupt, the standard fix may not weaken but, on the contrary, increase the reliability of the exploit. However, the latest Intel chips already include a special built-in instruction that helps resolve this issue.
An alternative option involves blocking interrupts directly within the vulnerable time window; however, such a solution would require excessive computational overhead and significantly reduce performance, making it impractical.
The researchers notified AMD and Intel of their discovery in early February and contacted the Linux kernel developers in March. The researchers also joined forces with AMD to alert cloud providers and other enterprise customers. Subsequently, AMD released a patch to address the vulnerability, which can be obtained through a standard operating system update. The developers have made the original research code publicly available.
This research was partially funded by the U.S. Air Force Office of Scientific Research through a grant from the U.S. Department of Defense, as well as by the ACE Center, one of seven research centers in the JUMP 2.0 program under the auspices of DARPA. The results will be officially presented this month at the Black Hat USA and USENIX Security conferences.
See also: Global Cyber Heist: Worldwide Losses from Hackers Have Reached $1.24 Trillion