{"id":47200,"date":"2022-06-21T15:17:59","date_gmt":"2022-06-21T15:17:59","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33563\/Hartzbleed-A-New-Side-Channel-Attack.html"},"modified":"2022-06-21T15:17:59","modified_gmt":"2022-06-21T15:17:59","slug":"hartzbleed-a-new-side-channel-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hartzbleed-a-new-side-channel-attack\/","title":{"rendered":"Hartzbleed: A New Side-Channel Attack"},"content":{"rendered":"
\n
\n

Hertzbleed: A New Side-Channel Attack<\/h2>\n

Hertzbleed is a new side-channel attack that works against a variety of microprocressors. Deducing cryptographic keys by analyzing power consumption has long been an attack, but it\u2019s not generally viable because measuring power consumption is often hard. This new attack<\/a> measures power consumption by measuring time, making it easier to exploit.<\/p>\n

\n

The team discovered that dynamic voltage and frequency scaling (DVFS)\u2014a power and thermal management feature added to every modern CPU\u2014allows attackers to deduce the changes in power consumption by monitoring the time it takes for a server to respond to specific carefully made queries. The discovery greatly reduces what\u2019s required. With an understanding of how the DVFS feature works, power side-channel attacks become much simpler timing attacks that can be done remotely.<\/p>\n

The researchers have dubbed their attack Hertzbleed because it uses the insights into DVFS to expose\u00ador bleed out\u00addata that\u2019s expected to remain private.<\/p>\n

[\u2026]<\/p>\n

The researchers have already shown how the exploit technique they developed can be used to extract an encryption key from a server running SIKE, a cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel.<\/p>\n

The researchers said they successfully reproduced their attack on Intel CPUs from the 8th to the 11th generation of the Core microarchitecture. They also claimed that the technique would work on Intel Xeon CPUs and verified that AMD Ryzen processors are vulnerable and enabled the same SIKE attack used against Intel chips. The researchers believe chips from other manufacturers may also be affected.<\/p>\n<\/blockquote>\n

Tags: cryptography<\/a>, keys<\/a>, side-channel attacks<\/a><\/span> <\/p>\n

Posted on June 20, 2022 at 6:23 AM<\/a> \u2022 31 Comments<\/a> <\/p>\n