Researchers have discovered yet another side-channel attack method that can be exploited to steal potentially sensitive data from devices powered by Intel processors.
Dubbed NetCAT (Network Cache ATtack), the new attack was identified by members of the Systems and Network Security Group at VU Amsterdam. The vulnerability that makes an attack possible, tracked as CVE-2019-11184, is related to Intel’s Data Direct I/O (DDIO) technology.
DDIO, a feature enabled by default on all Intel Xeon E5 and E7 v2 server processors, is designed to improve performance and reduce power consumption, and it provides network devices access to the CPU cache.
VU Amsterdam researchers have demonstrated that DDIO — particularly when Remote Direct Memory Access (RDMA) technology is also enabled —- allows a remote attacker to obtain data from an affected server by sending it specially crafted network packets.
The NetCAT attack does not require any malicious software to be executed on the remote server or client, and the experts have shown how it can be used to steal keystrokes from an SSH session.
“In an interactive SSH session, every time you press a key, network packets are being directly transmitted,” the researchers explained. “As a result, every time a victim you type a character inside an encrypted SSH session on your console, NetCAT can leak the timing of the event by leaking the arrival time of the corresponding network packet. Now, humans have distinct typing patterns. For example, typing ‘s’ right after ‘a’ is faster than typing ‘g’ after ‘s’. As a result, NetCAT can operate statical analysis of the inter-arrival timings of packets in what i ..
Support the originator by clicking the read the rest link below.
