When Good Turns Evil - Using Intel SGX to Stealthily Steal Bitcoins

This talk examines how Intel SGX can hide malware and protect it from detection while enabling cache attacks against secrets in co-located enclaves. It also presents double-fetch and atomic-fetch vulnerabilities in an SGX-protected DRM video player.

Syllabus

Outline
Introduction to SGX
Using SGX to implement Bitcoin wallets
Bitcoins Signatures
Cache Attacks
Prime and Rope
How does this work
Not that easy
Building the time
Physical address
Physical page
Addresses
Summary
Results
Performance Counter
Solution
Operating System
Hardware
Sidechain resistant crypto
DRM video player
Stealing Bitcoins
The Problem
Validity Period
Double Fetch Back
Shared Memory
Double Fetch Detection
Video Player Exploit
Double Fetches
Atomic Fetches
TFX
How it works
Dropit
Code
Advantages
Takeaways
Out of Scope
Conclusion