Moritz Lipp (@mlqxyz) / Twitter

Pinned Tweet

I've just successfully defended my #PhD thesis: "Exploiting Microarchitectural Optimizations from Software" which can be found online here mlq.me/download/phd-t Thanks to all my colleagues and friends, especially

@misc0110

and

@lavados

, for a wonderful and unforgettable time!

34

84

398

Moritz Lipp Retweeted

Pietro Borrello

@borrello_pietro

Aug 9, 2022

It affects 10th, 11th and 12th generation Intel CPUs, where the undefined range in APIC MMIO region returns stale data. ÆPIC Leak is *not* a transient execution attack: it is a bug in the CPU itself. In our work, we show how it precisely allows us to fully dump enclave in seconds

0:30

3.9K views

1

26

92

Show this thread

Moritz Lipp Retweeted

Pietro Borrello

@borrello_pietro

Aug 9, 2022

This has been an amazing collaboration with

Find out more at our BH USA talk tomorrow, and check out our USENIX 22 paper! paper: aepicleak.com/aepicleak.pdf github:

github.com

GitHub - IAIK/AEPIC

Contribute to IAIK/AEPIC development by creating an account on GitHub.

1

11

55

Show this thread

Moritz Lipp Retweeted

Pietro Borrello

@borrello_pietro

Aug 9, 2022

Today we disclose ÆPIC Leak: Architecturally Leaking Uninitialized Data from the Microarchitecture 🔥 It is the *first* architectural CPU bug able to leak sensitive data from the cache hierarchy: like an uninitialized read but in the CPU itself. aepicleak.com

9

284

702

Show this thread

Moritz Lipp Retweeted

The Register: Summary

@_TheRegister

Aug 9, 2022

Automated

A group of computer scientists has identified an architectural error in certain recent Intel CPUs that can be abused to expose SGX enclave data like private encryption keys. They call it ÆPIC Leak because it affects the memory-mapped registers of the l...

theregister.com

APIC fail: Intel 'Sunny Cove' chips with SGX spill secrets

AMD Zen chips, meanwhile, are vulnerable to side-channel data scrying

12

22

Moritz Lipp Retweeted

Andreas Kogler

@0xhilbert

May 19, 2022

Our paper "Finding and Exploiting CPU Features using MSR Templating" got accepted at S&P'22! Together with

we analyze the effects of MSRs on system security and show our findings in six case studies. Paper: andreaskogler.com/papers/msrtemp

5

49

128

Show this thread

Moritz Lipp Retweeted

Martin Schwarzl

@marv0x90

Nov 17, 2021

Happy to announce that our paper "Remote Memory-Deduplication Attacks" has been accepted at NDSS 2022. Great collaboration with

@ekraft95

@mlqxyz

and

@lavados

. Link to the paper: arxiv.org/pdf/2111.08553

4

21

59

Moritz Lipp

@mlqxyz

Oct 12, 2021

I am happy to announce that our paper "AMD Prefetch Attacks through Power and Time" has been accepted at

@USENIXSecurity

'22 mlq.me/download/amdpr /cc

@lavados

@misc0110

2

46

154

Moritz Lipp Retweeted

clearly make the most of the medium. :-D media.ccc.de/v/rc3-950679-a #rc3 #rc3two

2

3

11

Moritz Lipp

@mlqxyz

Dec 23, 2020

Warum leaked hier Strom? With the #rC3 schedule being online now, we are looking forward to our talk on how to attack CPUs with power side channels from software. #PLATYPUS /cc

@0xhilbert

@misc0110

@dgruss

2020-12-28 / 19:20 / rc2 fahrplan.events.ccc.de/rc3/2020/Fahrp

1

12

33

Moritz Lipp Retweeted

NSA Cyber

@NSACyber

Nov 30, 2020

Congratulations to the authors of “Spectre Attacks: Exploiting Speculative Execution,” for winning

@NSAGov

’s 8th Annual Best Scientific #Cybersecurity Research Paper Competition. Learn more about how this research makes processors & computers more secure: nsa.gov/News-Features/

7

47

84

Moritz Lipp

@mlqxyz

Nov 22, 2020

I am happy to announce that #PLATYPUS, our paper on software-based power side-channel attacks, has been accepted at

@IEEESSP

2021 #SP21. platypusattack.com /cc

2

36

163

Moritz Lipp Retweeted

David Oswald

@sublevado

Nov 13, 2020

With #VoltPillager, we show that Intel #SGX is vulnerable to low-cost hardware fault injection attacks - and that SGX cannot protect against an attacker with physical access (like malicious cloud provider). More details: zt-chen.github.io/voltpillager/

@halfdoof

@Vge0rge

@ZitaiChen

1

32

82

Moritz Lipp

@mlqxyz

Nov 10, 2020

With #PLATYPUS, we can successfully recover AES-NI keys processed inside an Intel SGX enclave. platypusattack.com /cc

GIF

1

14

Moritz Lipp Retweeted

Phoronix

@phoronix

Nov 10, 2020

#Intel Discloses 40 More #Security Advisories - #PLATYPUS Is An Interesting One phoronix.com/scan.php?page=

3

15

Moritz Lipp Retweeted

Ars Technica

@arstechnica

Nov 10, 2020

Intel SGX defeated yet again—this time thanks to on-chip power meter arstechnica.com/information-te by

@dangoodin001

arstechnica.com

Intel SGX defeated yet again—this time thanks to on-chip power meter

New research sends chipmaker scrambling to fix side channel that exposes secret data.

35

41

Moritz Lipp Retweeted

heise online

@heiseonline

Nov 10, 2020

"Platypus": Sicherheitslücke missbraucht Messfunktion von Intel-Prozessoren heise.de/news/Platypus- #infosec #Intel

heise.de

"Platypus": Sicherheitslücke missbraucht Messfunktion von Intel-Prozessoren

Sicherheitsforscher nutzen die zur Leistungsmessung gedachte RAPL-Schnittstelle aktueller Prozessoren, um geheime Daten zu ergattern, die die CPU verarbeitet.

28

30

Moritz Lipp Retweeted

Michael Schwarz

@misc0110

Nov 10, 2020

See #PLATYPUS in action: breaking kernel address space layout randomization within seconds by observing the CPU's power consumption with RAPL. platypusattack.com

GIF

64

151

Moritz Lipp Retweeted

Jerry Bryant

@jerry_Intel

Nov 10, 2020

November 2020 security advisories are published including INTEL-SA-00389 RAPL (aka Platypus). blogs.intel.com/technology/202

10

Moritz Lipp

@mlqxyz

Nov 10, 2020

With #PLATYPUS, we present software-based power side-channel attacks leaking cryptographic keys on modern CPUs. platypusattack.com /cc

4

165

264

Moritz Lipp Retweeted

Black Hat

@BlackHatEvents

Sep 1, 2020

In this #BHASIA Briefing,

@misc0110

&

@mlqxyz

shows that Meltdown is still an issue on modern CPUs and presents ZombieLoad - a Meltdown-type attack which leaks data across multiple privilege boundaries. Register before 9/2 to save on registration ow.ly/KPJZ50BciVE

4

15

Moritz Lipp Retweeted

Daniel Moghimi

@flowyroll

Jul 14, 2020

While recording talks for

@USENIXSecurity

2020, excited to mention our work on automated analysis and synthesis of MDS-style CPU attacks "Medusa: Microarchitectural Data Leakage via Automated Attack Synthesis" usenix.org/conference/use CC

@mlqxyz

@berksunar

@misc0110

1

6

31

Show this thread

Moritz Lipp Retweeted

Phoronix

@phoronix

Mar 12, 2020

The Brutal Performance Impact From Mitigating The #LVI Vulnerability #Security A number of workloads can be at ~10% of their pre-mitigated performance, e.g. OpenSSL and others. phoronix.com/scan.php?page=

4

65

110

Show this thread

Moritz Lipp Retweeted

Pawel Wieczorkiewicz

@wipawel

Mar 10, 2020

Meet Snoopy: INTEL-SA-00330 intel.com/content/www/us

2

12

28

Moritz Lipp Retweeted

Danilo "18pF flip-flop"

@dcominottim

Mar 10, 2020

To put any doubts about the funding of that paper on AMD CPU vulnerabilities to rest, the new LVI research has been funded by Intel, AMD, and ARM. #SiliconGang

3

17

43

Moritz Lipp Retweeted

Jo Van Bulck

@jovanbulck

Mar 10, 2020

Crucially, unlike prior attacks, #LVI cannot be transparently mitigated on current CPUs and requires expensive compiler mitigations that insert an LFENCE after potentially *every* memory load and blacklist the x86 RET instruction-- we measure overheads of factor 2 up to 19(!)

1

30

55

Show this thread

Moritz Lipp Retweeted

Jerry Bryant

@jerry_Intel

Mar 10, 2020

Also, take a look at the Refined Speculative Execution Terminology paper:

intel.com

Software Security Guidance from Intel

Find software developer resources, guidance, and insights for security advisories.

2

25

35

Moritz Lipp Retweeted

Michael Schwarz

@misc0110

Mar 10, 2020

With #LVI (Load Value Injection), we present a new class of transient-execution attacks that extends the classification tree by an entirely new branch. lviattack.eu /cc

@danielmgmi

Quote Tweet

We present Load Value Injection #LVI: a new transient-execution attack class; defeats defenses; turns around #Meltdown #Foreshadow #ZombieLoad #RIDL #Fallout to *inject* attacker data into victim loads. lviattack.eu cc @danielmgmi @mlqxyz @misc0110 @lavados @IEEESSP

Show this thread

32

54

Moritz Lipp Retweeted

Jo Van Bulck

@jovanbulck

Mar 10, 2020

We present Load Value Injection #LVI: a new transient-execution attack class; defeats defenses; turns around #Meltdown #Foreshadow #ZombieLoad #RIDL #Fallout to *inject* attacker data into victim loads. lviattack.eu cc @danielmgmi

6

175

257

We present #LVI (Load Value Injection), a new class of transient-execution attacks exploiting microarchitectural flaws in modern processors. lviattack.eu /cc

@jovanbulck

@danielmgmi

@misc0110

@lavados

19

46

Moritz Lipp

@mlqxyz

Mar 6, 2020

With "Take A Way: Exploring the Security Implications of AMD’s Cache Way Predictors", we reverse-engineered AMD's L1D cache way predictor, resulting in two new attack techniques. Accepted @ #AsiaCCS '20 - mlq.me/download/takea - /cc

7

88

155

Moritz Lipp Retweeted

Replying to

and

No, it was the same for ZombieLoad, this is also described in the paper from November

4

11

Moritz Lipp

@mlqxyz

Jan 27, 2020

With L1D Eviction Sampling, we show that the mitigations against #MDS-type attacks are insufficient and data can still be leaked with #ZombieLoad! Check out zombieloadattack.com to find out more! /cc

@danielmgmi

13

25

Moritz Lipp Retweeted

In this talk,

&

show that Meltdown is still an issue on modern CPUs and present ZombieLoad - a Meltdown-type attack which leaks data across multiple privilege boundaries. Register now to save on a Briefings pass to hear this talk and more ow.ly/RWds50xXphu

1

11

23

Moritz Lipp

@mlqxyz

Dec 28, 2019

Return of the Leaking Dead! Join our #ZombieLoad talk at #36C3 at 23:30 in Ada fahrplan.events.ccc.de/congress/2019/ /w

@misc0110

@lavados

1

4

26

Moritz Lipp Retweeted

Daniel Gruss

@lavados

Dec 10, 2019

Embargo ends - #PlunderVolt is public: plundervolt.com It allows to induce faults into computations in SGX, breaking crypto and corrupting memory. youtube.com/watch?v=In3B9L Great collaboration with Kit Murdock,

,

,

, Frank Piessens!!

Plundervolt- Faulting AES inside SGX

6

161

227

Show this thread

Moritz Lipp Retweeted

Daniel Moghimi

@flowyroll

Nov 12, 2019

Another patch Tuesday surprise: Local/Remote timing side-channel attacks on Trusted Platform Modules (TPMs) A CC4+ Certified TPM hardware and Intel PTT (firmware-TPM) are affected. @danielmgmi

@berksunar

@tomcrypt

@nadiaheninger

tpm.fail #sidechannel #TPM

4

48

70

Show this thread

Moritz Lipp Retweeted

Daniel Gruss

@lavados

Nov 12, 2019

With issues during some disclosures, Intel took our concerns *very* seriously and improved the communication and handling of issues *substantially* over the past year. This deserves recognition and I want to thank Intel for improving the process. #zombieload #meltdown #spectre

1

19

131

Moritz Lipp Retweeted

TechCrunch

@TechCrunch

Nov 12, 2019

New: A new 'Zombieload' vulnerability has been found — this time in Intel's newest chip family, Cascade Lake. The researchers said Intel's efforts to change the chip design to protect against these kinds of attacks were “not sufficient.”

techcrunch.com

A new security flaw hits Intel's Cascade Lake chips

Time to reset your “days since last major chip vulnerability” counter back to zero. Security researchers have found another flaw in Intel processors — this time it’s a new variant of the Zombieload...

2

63

77

Moritz Lipp

@mlqxyz

Nov 12, 2019

#ZombieLoad is back: With our new variant, the #ZombieLoad attack can be mounted on recent #MDS-resistant Intel CPUs! Checkout our updated paper on zombieloadattack.com to find out more! /cc

@danielmgmi

49

61

Moritz Lipp’s Tweets