SoK: How not to architect your next-generation TEE malware?

Conference item

Besides Intel’s SGX technology, there are long-running discussions on how trusted computing technologies can be used to cloak malware. Past research showed example methods of malicious activities utilising Flicker, Trusted Platform Module, and recently integrating with enclaves. We observe two ambiguous methodologies of malware development being associated with SGX, and it is crucial to systematise their details. One methodology is to use the core SGX ecosystem to cloak malware; potentially affecting a large number of systems. The second methodology is to create a custom enclave not adhering to base assumptions of SGX, creating a demonstration code of malware behaviour with these incorrect assumptions; remaining local without any impact. We examine what malware aims to do in real-world scenarios and state-of-art techniques in malware evasion. We present multiple limitations of maintaining the SGX-assisted malware and evading it from anti-malware mechanisms. The limitations make SGX enclaves a poor choice for achieving a successful malware campaign. We systematise twelve misconceptions (myths) outlining how an overfit-malware using SGX weakens malware’s existing abilities. We find the differences by comparing SGX assistance for malware with non-SGX malware (i.e., malware in the wild in our paper). We conclude that the use of hardware enclaves does not increase the preexisting attack surface, enables no new infection vector, and does not contribute any new methods to the stealthiness of malware.

Authors: Kucuk, KA; Moyle, S; Martin, A; Mereacre, A; Allott, N

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: Association for Computing Machinery
• Host title: HASP '22: Proceedings of the 11th International Workshop on Hardware and Architectural Support for Security and Privacy
• Pages: 35–44
• Publication date: 2023-09-21
• Acceptance date: 2022-09-20
• Event title: Hardware and Architectural Support for Security and Privacy (HASP 2022)
• Event location: Chicago, Illinois, USA
• Event website: https://haspworkshop.org/2022/program.html
• Event start date: 2022-10-01
• Event end date: 2022-10-01
• DOI: 10.1145/3569562.3569568
• ISBN: 978-1-4503-9871-8
• Language: English
• Keywords: malware in commodity systems; trusted execution environments (TEE); FFR; software guard eXtensions (SGX); malware in enclave; Evil Light Bulb (ELB) in IoT