DOCSLIB.ORG

Extracting the Keys to the Intel SGX Kingdom with Transient Out-Of-Order Execution

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Extracting the Keys to the Intel SGX Kingdom with Transient Out-Of-Order Execution FORESHADOW: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution Jo Van Bulck1, Marina Minkin2, Ofir Weisse3, Daniel Genkin3, Baris Kasikci3, Frank Piessens1, Mark Silberstein2, Thomas F. Wenisch3, Yuval Yarom4, and Raoul Strackx1 1imec-DistriNet, KU Leuven, 2Technion, 3University of Michigan, 4University of Adelaide and Data61 Abstract distrusting enclaves with a minimal Trusted Computing Base (TCB) that includes only the processor package and Trusted execution environments, and particularly the Soft- microcode. Enclave-private CPU and memory state is ware Guard eXtensions (SGX) included in recent Intel exclusively accessible to the code running inside it, and x86 processors, gained significant traction in recent years. remains explicitly out of reach of all other enclaves and A long track of research papers, and increasingly also real- software running at any privilege level, including a po- world industry applications, take advantage of the strong tentially malicious operating system and/or hypervisor. hardware-enforced confidentiality and integrity guaran- Besides strong memory isolation, TEEs typically offer an tees provided by Intel SGX. Ultimately, enclaved execu- attestation primitive that allows local or remote stakehold- tion holds the compelling potential of securely offloading ers to cryptographically verify at runtime that a specific sensitive computations to untrusted remote platforms. enclave has been loaded on a genuine (and hence pre- We present Foreshadow, a practical software-only mi- sumed to be secure) TEE processor. croarchitectural attack that decisively dismantles the se- With the announcement of Intel’s Software Guard eX- curity objectives of current SGX implementations. Cru- tensions (SGX) [2, 27, 43] in 2013, hardware-enforced cially, unlike previous SGX attacks, we do not make any TEE isolation and attestation guarantees are now available assumptions on the victim enclave’s code and do not on off-the-shelf x86 processors. In light of the strong se- necessarily require kernel-level access. At its core, Fore- curity guarantees promised by Intel SGX, industry actors shadow abuses a speculative execution bug in modern are increasingly adopting this technology in a wide variety Intel processors, on top of which we develop a novel ex- of applications featuring secure execution on adversary- ploitation methodology to reliably leak plaintext enclave controlled machines. Open Whisper Systems [50] re- secrets from the CPU cache. We demonstrate our attacks lies on SGX for privacy-friendly contact discovery in its by extracting full cryptographic keys from Intel’s vetted Signal network. Both Microsoft and IBM recently an- architectural enclaves, and validate their correctness by nounced support for SGX in their cloud infrastructure. launching rogue production enclaves and forging arbitrary Various off-the-shelf Blu-ray players and initially also the local and remote attestation responses. The extracted re- 4K Netflix client furthermore use SGX to enforce Digi- mote attestation keys affect millions of devices. tal Rights Management (DRM) for high-resolution video streams. Emerging cryptocurrencies [44] and innovative 1 Introduction blockchain technologies [25] rely even more critically on the correctness of Intel SGX. It becomes inherently difficult to place trust in modern, widely used operating systems and applications whose Our Contribution. This paper shows, however, that sizes can easily reach millions of lines of code, and where current SGX implementations cannot meet their security a single vulnerability can often lead to a complete collapse objectives. We present the Foreshadow attack, which of all security guarantees. In response to these challenges, leverages a speculative execution bug in recent Intel x86 recent research [11,41,48] and industry efforts [1,2,35,43] processors to reliably leak plaintext enclave secrets from developed Trusted Execution Environments (TEEs) that the CPU cache. At its core, Foreshadow abuses the same feature an alternative, non-hierarchical protection model processor vulnerability as the recently announced Melt- for isolated application compartments called enclaves. down [40] attack, i.e., a delicate race condition in the TEEs enforce the confidentiality and integrity of mutually CPU’s access control logic that allows an attacker to use the results of unauthorized memory accesses in transient • We evaluate the effectiveness and bandwidth of the out-of-order instructions before they are rolled back. Im- Foreshadow attack through controlled experiments. portantly, however, whereas Meltdown targets traditional hierarchical protection domains, Foreshadow considers • We extract full cryptographic keys from Intel’s archi- a very different attacker model where the adversary’s tectural enclaves, and demonstrate how to( i) bypass goal is not to read kernel memory from user space, but enclave launch control; and( ii) forge local and re- to compromise state-of-the-art intra-address space en- mote attestations to completely break confidentiality clave protection domains that are not covered by recently plus integrity guarantees for remote computations. deployed kernel page table isolation defenses [19]. We explain how Foreshadow necessitates a novel exploitation Current Status. Following responsible disclosure prac- methodology, and we show that our basic attack can be en- tices, we notified Intel about our attacks in January tirely mounted by an unprivileged adversary without root 2018. Intel acknowledged the novelty and severity of access to the victim machine. Given SGX’s unique privi- Foreshadow-type “L1 Terminal Fault” attacks, and as- leged attacker model, however, we additionally contribute signed CVE-2018-3615 to the results described in this a set of optional kernel-level optimization techniques to paper. We were further indicated that our attacks affect all further reduce noise for root adversaries. Our findings SGX-enabled Core processors, while some Atom family have far-reaching consequences for the security model processors with SGX support allegedly remain unaffected. pursued by Intel SGX in that, in the absence of a mi- At the time of this writing, Intel assigned CVSS severity crocode patch, current SGX processors cannot guarantee ratings of “high” and “low” for respectively confidential- the confidentiality of enclaved data nor attest the integrity ity and integrity. We note, however, that Foreshadow also of enclaved execution, including for Intel’s own archi- affects the integrity of enclaved computations, since our tectural enclaves. Moreover, despite SGX’s ambition to attacks can arbitrarily modify sealed storage, and forge defend against strong kernel-level adversaries, present local and remote attestation responses. SGX processors cannot even safeguard enclave secrets in Intel confirmed that microcode patches are underway the presence of unprivileged user space attackers. and should be deployed concurrently to the public re- All previously known attacks against Intel SGX rely on lease of our results. As of this writing, however, we have application-specific information leakage from either side- not been provided with substantial technical information channels [30, 39, 45, 51, 57, 58, 60] or software vulnerabil- about these mitigations. We discuss defense strategies in ities [38,59]. It was generally believed that well-written Section 6, and provide further guidelines on the impact enclaves could prevent information leakage by adhering of our findings at https://foreshadowattack.eu/. to good coding practices, such as never branching on secrets, prompting Intel to state that “in general, these Disclosure. Foreshadow was independently and concur- research papers do not demonstrate anything new or unex- rently discovered by two teams. The KU Leuven authors pected about the Intel SGX architecture. Preventing side discovered the vulnerability, independently developed the channel attacks is a matter for the enclave developer” [33]. attack, and first notified Intel on January 3, 2018. Their Foreshadow defeats this argument, however, as it relies work was done independently from and concurrently to solely on elementary Intel x86 CPU behavior and does not other recent x86 speculative execution vulnerabilities, no- exploit any software vulnerability, or even require knowl- tably Meltdown and Spectre [36, 40]. The authors from edge of the victim enclave’s source code. We demonstrate Technion, University of Michigan, and the University this point by being the first to actually extract long-term of Adelaide independently discovered and reported the platform launch and attestation keys from Intel’s critical vulnerability to Intel during the embargo period on Jan- and thoroughly vetted architectural launch and quoting en- uary 23, 2018. claves, decisively dismantling SGX’s security objectives. In summary, our contributions are: 2 Background • We advance the understanding of Meltdown-type We first overview Intel SGX [2, 10, 27, 43] and refine transient execution CPU vulnerabilities by showing the attacker model. Thereafter, we introduce the relevant that they also apply to intra-address space isolation parts of the x86 microarchitecture, and discuss previous and SGX’s non-terminating abort page semantics. research results on speculative execution vulnerabilities. • We present novel exploitation methodologies that 2.1 Intel SGX allow an unprivileged software-only attacker to re- liably extract enclave secrets residing in either pro- Memory Isolation. SGX enclaves
Load more

Recommended publications
  • 2020 Sonicwall Cyber Threat Report
    2020 SONICWALL CYBER THREAT REPORT sonicwall.com I @sonicwall TABLE OF CONTENTS 3 A NOTE FROM BILL 4 CYBERCRIMINAL INC. 11 2019 GLOBAL CYBERATTACK TRENDS 12 INSIDE THE SONICWALL CAPTURE LABS THREAT NETWORK 13 KEY FINDINGS FROM 2019 13 SECURITY ADVANCES 14 CRIMINAL ADVANCES 15 FASTER IDENTIFICATION OF ‘NEVER-BEFORE-SEEN’ MALWARE 16 TOP 10 CVES EXPLOITED IN 2019 19 ADVANCEMENTS IN DEEP MEMORY INSPECTION 23 MOMENTUM OF PERIMETER-LESS SECURITY 24 PHISHING DOWN FOR THIRD STRAIGHT YEAR 25 CRYPTOJACKING CRUMBLES 27 RANSOMWARE TARGETS STATE, PROVINCIAL & LOCAL GOVERNMENTS 31 FILELESS MALWARE SPIKES IN Q3 32 ENCRYPTED THREATS GROWING CONSISTENTLY 34 IOT ATTACK VOLUME RISING 35 WEB APP ATTACKS DOUBLE IN 2019 37 PREPARING FOR WHAT’S NEXT 38 ABOUT SONICWALL 2 A NOTE FROM BILL The boundaries of your digital empire are In response, SonicWall and our Capture Labs limitless. What was once a finite and threat research team work tirelessly to arm defendable space is now a boundless organizations, enterprises, governments and territory — a vast, sprawling footprint of businesses with actionable threat devices, apps, appliances, servers, intelligence to stay ahead in the global cyber networks, clouds and users. arms race. For the cybercriminals, it’s more lawless And part of that dedication starts now with than ever. Despite the best intentions of the 2020 SonicWall Cyber Threat Report, government agencies, law enforcement and which provides critical threat intelligence to oversight groups, the current cyber threat help you better understand how landscape is more agile than ever before. cybercriminals think — and be fully prepared for what they’ll do next.
    [Show full text]
  • Internet Security Threat Report Volume 24 | February 2019
    ISTRInternet Security Threat Report Volume 24 | February 2019 THE DOCUMENT IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENT. THE INFORMATION CONTAINED IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE. INFORMATION OBTAINED FROM THIRD PARTY SOURCES IS BELIEVED TO BE RELIABLE, BUT IS IN NO WAY GUARANTEED. SECURITY PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT (“CONTROLLED ITEMS”) ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER FOR YOU TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT SUCH CONTROLLED ITEMS. TABLE OF CONTENTS 1 2 3 BIG NUMBERS YEAR-IN-REVIEW FACTS AND FIGURES METHODOLOGY Formjacking Messaging Cryptojacking Malware Ransomware Mobile Living off the land Web attacks and supply chain attacks Targeted attacks Targeted attacks IoT Cloud Underground economy IoT Election interference MALICIOUS
    [Show full text]
  • Systematization of Vulnerability Discovery Knowledge: Review
    Systematization of Vulnerability Discovery Knowledge Review Protocol Nuthan Munaiah and Andrew Meneely Department of Software Engineering Rochester Institute of Technology Rochester, NY 14623 {nm6061,axmvse}@rit.edu February 12, 2019 1 Introduction As more aspects of our daily lives depend on technology, the software that supports this technology must be secure. We, as users, almost subconsciously assume the software we use to always be available to serve our requests while preserving the confidentiality and integrity of our information. Unfortunately, incidents involving catastrophic software vulnerabilities such as Heartbleed (in OpenSSL), Stagefright (in Android), and EternalBlue (in Windows) have made abundantly clear that software, like other engineered creations, is prone to mistakes. Over the years, Software Engineering, as a discipline, has recognized the potential for engineers to make mistakes and has incorporated processes to prevent such mistakes from becoming exploitable vulnerabilities. Developers leverage a plethora of processes, techniques, and tools such as threat modeling, static and dynamic analyses, unit/integration/fuzz/penetration testing, and code reviews to engineer secure software. These practices, while effective at identifying vulnerabilities in software, are limited in their ability to describe the engineering failures that may have led to the introduction of vulnerabilities. Fortunately, as researchers propose empirically-validated metrics to characterize historical vulnerabilities, the factors that may have led to the introduction of vulnerabilities emerge. Developers must be made aware of these factors to help them proactively consider security implications of the code that they contribute. In other words, we want developers to think like an attacker (i.e. inculcate an attacker mindset) to proactively discover vulnerabilities.
    [Show full text]
  • Ghostbuster: Understanding and Overcoming the Pitfalls of Transient Execution Vulnerability Checkers
    GhostBuster: understanding and overcoming the pitfalls of transient execution vulnerability checkers Andrea Mambretti∗y, Pasquale Convertiniy, Alessandro Sorniottiy, Alexandra Sandulescuy, Engin Kirda∗ and Anil Kurmusy ∗Khoury College of Computer Sciences, Northeastern University, Boston, USA Email: fmbr, [email protected] y IBM Research - Zurich, Rueschlikon, Switzerland Email: [email protected], faso, asa, [email protected] Abstract—Transient execution vulnerabilities require system co-located thread, and the threat model requires that the victim administrators to evaluate whether their systems are vulnerable process contains a side channel primitive allowing leakage of and whether available mitigations are enabled. They are aided sensitive data. While some of these attacks are exploitable in in this task by multiple community-developed tools, transient real-world settings, others have not left the realm of theoretical execution vulnerability checkers. Yet, no analysis of these tools vulnerabilities. exists, in particular with respect to their shortcomings and whether they might mislead administrators into a false sense Owing to the high number of transient execution attacks of security. In this paper, we provide the first comprehensive (both practical and theoretical) and the multitude of mitigation analysis of these tools and underpinning methodologies. We mechanisms, the degree to which systems are safe against run the tools on a large set of combinations of Intel/AMD speculative execution attackers is often hard to determine. The architectures and Linux kernel versions and report on their determination is made even more complex by the fact that a efficacy and shortcomings. We also run these tools on 17 of the most prominent cloud providers, report the collected results system might be affected by a certain microarchitectural attack and present the current status on the preparedness of the IT vector, while being safe in practice because the conditions of hosting industry against this class of attacks.
    [Show full text]
  • Class-Action Lawsuit
    Case 3:20-cv-00863-SI Document 1 Filed 05/29/20 Page 1 of 279 Steve D. Larson, OSB No. 863540 Email: [email protected] Jennifer S. Wagner, OSB No. 024470 Email: [email protected] STOLL STOLL BERNE LOKTING & SHLACHTER P.C. 209 SW Oak Street, Suite 500 Portland, Oregon 97204 Telephone: (503) 227-1600 Attorneys for Plaintiffs [Additional Counsel Listed on Signature Page.] UNITED STATES DISTRICT COURT DISTRICT OF OREGON PORTLAND DIVISION BLUE PEAK HOSTING, LLC, PAMELA Case No. GREEN, TITI RICAFORT, MARGARITE SIMPSON, and MICHAEL NELSON, on behalf of CLASS ACTION ALLEGATION themselves and all others similarly situated, COMPLAINT Plaintiffs, DEMAND FOR JURY TRIAL v. INTEL CORPORATION, a Delaware corporation, Defendant. CLASS ACTION ALLEGATION COMPLAINT Case 3:20-cv-00863-SI Document 1 Filed 05/29/20 Page 2 of 279 Plaintiffs Blue Peak Hosting, LLC, Pamela Green, Titi Ricafort, Margarite Sampson, and Michael Nelson, individually and on behalf of the members of the Class defined below, allege the following against Defendant Intel Corporation (“Intel” or “the Company”), based upon personal knowledge with respect to themselves and on information and belief derived from, among other things, the investigation of counsel and review of public documents as to all other matters. INTRODUCTION 1. Despite Intel’s intentional concealment of specific design choices that it long knew rendered its central processing units (“CPUs” or “processors”) unsecure, it was only in January 2018 that it was first revealed to the public that Intel’s CPUs have significant security vulnerabilities that gave unauthorized program instructions access to protected data. 2. A CPU is the “brain” in every computer and mobile device and processes all of the essential applications, including the handling of confidential information such as passwords and encryption keys.
    [Show full text]
  • Public Clouds and Vulnerable Cpus: Are We Secure? FOSDEM 2020
    Public clouds and vulnerable CPUs: are we secure? FOSDEM 2020 Vitaly Kuznetsov <[email protected]> About About myself ● Focusing (mostly) on Linux kernel ● My areas of interest include: ○ Linux as guest on public clouds (AWS, Azure, Aliyun,...) ○ Linux as guest on Hyper-V ○ Hyper-V Enlightenments in KVM ○ Running nested KVM on Hyper-V ○ Running nested Hyper-V on KVM Speculative vulnerabilities Speculative vulnerabilities discovered in the past few years: ● Spectre v1 ○ SWAPGS ● Spectre v2 ● Meltdown (Spectre v3) ● SSB (Spectre v4/NG) ● L1TF (AKA Foreshadow/Spectre v5) ● MDS & TAA Speculative vulnerabilities Speculative Execution Side Channel Methods Intel: “The concept behind speculative execution is that instructions are executed ahead of knowing that they are required. [...] By executing instructions speculatively, performance can be increased by minimizing latency and extracting greater parallelism. …. While speculative operations do not affect the architectural state of the processor, they can affect the microarchitectural state, such as information stored in Translation Lookaside Buffers (TLBs) and caches. ... A side channel method works by gaining information through observing the system, such as by measuring microarchitectural properties about the system. Unlike buffer overflows and other vulnerability classes, side channels do not directly influence the execution of the program, nor do they allow data to be modified or deleted. ” Speculative vulnerabilities and public clouds When running on a public cloud … but my cloud provider
    [Show full text]
  • Viewed Through the Prism of Clausewitzian Strategy
    CYBERWAR – VIEWED THROUGH THE PRISM OF CLAUSEWITZIAN STRATEGY Commodore Vishwanathan K Ganapathi, VSM Introduction In a globalised world where speed and reliability of information exchange is thesine qua non of technological advancement, the importance of cyberspace to a country is immeasurable. Knowledge and awareness, which derive from the degree to which cyberspace can be exploited for rapidly storing, manipulating and disseminating data, have become important measures of a nation’s power.1 As a consequence, the destruction or disruption of any of the constituent elements of cyberspace from a cyber attack would not just blunt a country’s ability to gain strategic advantage from its technological superiority but would gravely threaten its security as well. Depending on their intensity and complexity, cyber attacks can inflict a wide spectrum of damage ranging from less dangerous depredations like the theft of personal information and digital heists to highly destructive actions like the disruption of critical infrastructure- ‘the facilities, systems, sites and networks necessary for the delivery of essential services and functions’2 - industrial sabotage, subversion, data destruction or theft of sensitive information. It is the latter category, most often believed to be orchestrated for political reasons by a potential adversary, which has transformed cyber attacks from being perceived as a trivial problem befitting address by an IT professional to one that merits the focus of policy planners and strategists alike.3 The concerns of governments about the gravity of the threat from cyber attacks stem from the certitude that easily accessible destructive technologies are being exploited by state and non-state actors alike to launch attacks even against powerful adversaries several thousand miles away.
    [Show full text]
  • A Survey of Published Attacks on Intel
    1 A Survey of Published Attacks on Intel SGX Alexander Nilsson∗y, Pegah Nikbakht Bideh∗, Joakim Brorsson∗zx falexander.nilsson,pegah.nikbakht_bideh,[email protected] ∗Lund University, Department of Electrical and Information Technology, Sweden yAdvenica AB, Sweden zCombitech AB, Sweden xHyker Security AB, Sweden Abstract—Intel Software Guard Extensions (SGX) provides a Unfortunately, a relatively large number of flaws and attacks trusted execution environment (TEE) to run code and operate against SGX have been published by researchers over the last sensitive data. SGX provides runtime hardware protection where few years. both code and data are protected even if other code components are malicious. However, recently many attacks targeting SGX have been identified and introduced that can thwart the hardware A. Contribution defence provided by SGX. In this paper we present a survey of all attacks specifically targeting Intel SGX that are known In this paper, we present the first comprehensive review to the authors, to date. We categorized the attacks based on that includes all known attacks specific to SGX, including their implementation details into 7 different categories. We also controlled channel attacks, cache-attacks, speculative execu- look into the available defence mechanisms against identified tion attacks, branch prediction attacks, rogue data cache loads, attacks and categorize the available types of mitigations for each presented attack. microarchitectural data sampling and software-based fault in- jection attacks. For most of the presented attacks, there are countermeasures and mitigations that have been deployed as microcode patches by Intel or that can be employed by the I. INTRODUCTION application developer herself to make the attack more difficult (or impossible) to exploit.
    [Show full text]
  • 2019 Sonicwall Cyber Threat Report
    MID-YEAR UPDATE | JULY 2019 2019 SONICWALL CYBER THREAT REPORT Arm Your Business with the Latest Threat Intelligence from the First Half of 2019 SONICWALL CAPTURE LABS 1 MILLION + THREAT NETWORK Sensors 215 + Countries & Territories 24 x 7 x 365 Monitoring < 24 HOURS Threat Response 140K + Malware Samples Collected Daily 28M + Attacks BlockeD Daily 2019 GLOBAL CYBER ARMS RACE 2018 1H 2019 1H SonicWall recorded more than 4.78 billion malware attacKs for the first half of 2019 — a 20% year-to-date 5.99 Billion decrease. 4.78 Billion Global malware volume dips to start 2019, but other attack types rebound. MALWARE INTRUSION WEB APP RANSOMWARE IOT ENCRYPTED CYBERATTACK TRENDS ATTACKS ATTEMPTS ATTACKS ATTACKS MALWARE THREATS 76% 55% As global malware 11% 15% volume declines, 4% other attacK types increase during -20% the first half of 2019. 4.8 BILLION 2.0 TRILLION 19.2 MILLION 110.9 MILLION 13.5 MILLION 2.5 MILLION 2019 MALWARE VOLUME: TOP GLOBAL COUNTRIES 2019 Malware Attacks Top Countries Malware attacks 52.0 are largely down in France -53% 2019 witH a few Netherlands 56.5 +3% exceptions. Germany 66.5 -63% Switzerland 75.9 +72% InDia (25%), SwitzerlanD Brazil -4% 121.2 (72%) anD tHe China -61% 138.3 NetHerlanDs (3%) were the top coUntries that Canada -11% 155.4 sUffereD increaseD India +25% 226.9 malware activity. United Kingdom -9% 313.6 United States -17% 2,494.5 - 500 1,000 1,500 2.000 2,500 3,000 MILLIONS RANSOMWARE STILL RISING Ransomware VolUme YTD 110.9 Million Ransomware AttacKs 1H 2018 1H 2019 Change U.K.
    [Show full text]
  • Indicative Guidelines for Chemical Safety and Security in Small and Medium-Sized Enterprises to Foster the Peaceful Uses of Chemistry
    Indicative Guidelines for Chemical Safety and Security in Small and Medium-sized Enterprises to Foster the Peaceful Uses of Chemistry OPCW Organisation for the Prohibition of Chemical Weapons © Organisation for the Prohibition of Chemical Weapons, The Hague, the Netherlands, 2021 No use of this document may be made for any commercial purpose whatsoever without prior permission in writing from the OPCW. The views expressed in any article of this document do not necessarily represent those of the OPCW and the OPCW accepts no responsibility for them. Mention of the names of firms and commercial products does not imply endorsement by the OPCW. The use of general descriptive names, registered names, trademarks, etc. does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Editors: N. Kojevnikov, L. Zhao, H. Mat Som, T. Zhang Indicative Guidelines for Chemical Safety and Security in Small and Medium-sized Enterprises to Foster the Peaceful Uses of Chemistry The Outcome of the Workshops on Developing Tools for Chemical Safety and Security Management TABLE OF CONTENTS 1 PREFACE ..................................................................................................................... 1 2 TABLE OF ACRONYMS AND ABBREVIATIONS ............................................... 3 3 INTRODUCTION ........................................................................................................ 5 3.1 Role of the Employer ...........................................................................................
    [Show full text]
  • Morpheus Adaptive Defenses for Tomorrow’S Secure Systems
    Morpheus Adaptive Defenses for Tomorrow’s Secure Systems Todd Austin University of Michigan [email protected] Joint work with: Valeria Bertacco (UM) Sharad Malik (Princeton) Mohit Tiwari (UT-Austin) Assessing the State of Security • Jeep hacked remotely while driving • DHS attacks Boeing 757, details classified • Pacemaker wirelessly infiltrated • Mirai botnet disables DynDNS • Entire baby monitor market hacked • Atrium fish tank thermometer hacked 2 Why is Security So Hard to Get Right? • Currently, a patch-based approach • Find and fix vulnerabilities • Complexity growth far outstrips security • Manual testing & analyses don’t scale • Endless security arms race • Patch and pray… • How do we protect against unknown (0-day) attacks? • Anticipate the “unknown unknowns” 3 Attacking is Easy, Protecting is HARD • Attacking is easier than protecting • Attackers needs only one vulnerability • Protecting requires 100% coverage • Related software growth rates: • Protections: doubles every 2 years • Malware: 40% growth in 30 years • Vulnerabilities are on the rise • Rate of attacks is exploding 4 Durable Security: the Big Unsolved Challenge • What we do well: Synopsys’ Valgrind • Finding and fixing vulnerabilities Coverity Tools Intel’s • Deploying system protections that ARM’s Control-Flow stop well-known attacks TrustZone Enforcement • Where we fail: identifying and stopping emergent attacks 5 What If a Secure System Could… • Respond lightning-fast against common attacks • Self-adapt quickly to unknown emerging threats • Learn and prioritize
    [Show full text]
  • Controlling Cyberwarfare International Laws of Armed Conflict and Human Rights in the Cyber Realm
    Controlling Cyberwarfare International Laws of Armed Conflict and Human Rights in the Cyber Realm by William James Jordan A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Doctor of Philosophy in Philosophy Waterloo, Ontario, Canada, 2021 © William James Jordan 2021 Examining Committee Membership The following served on the Examining Committee for this thesis. Thedeci­ sion of the Examining Committee is by majority vote. External Examiner: Col. David Barnes Professor, Department of English and Philosophy United States Military Academy Supervisor: W. Mathieu Doucet Associate Professor, Department of Philosophy University of Waterloo Internal Member: Brian D. Orend Professor, Department of Philosophy University of Waterloo Internal Member: Patricia A. Marino Professor, Department of Philosophy University of Waterloo Internal­External Member: Veronica M. Kitchen Associate Professor, Department of Political Science University of Waterloo ii Author’s Declaration I hereby declare that I am the sole author of this thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my ex­ aminers. I understand that my thesis may be made electronically available to the pub­ lic. iii Abstract Cyberwarfare, military activities in cyberspace conducted by a state against another state and intended to disrupt or destroy computing or communica­ tion systems or data, is a recent addition to the warfaring arsenal. The in­ ternational laws of armed conflict set out an obligation for states at warto protect civilians from the effects of the conflict. As societies continue toex­ pand their activities in the cyber realm, the risk of cyberwarfare negatively affecting the civilian population increases.
    [Show full text]