A new microprocessor design is being lauded for its security features after nearly 600 experts failed to hack it in a series of tests last summer. The new processor, codenamed “Morpheus,” continually rewrites its own architecture, making it impossible for an attacker to target the kinds of flaws that allow Spectre and Meltdown-style side-channel attacks against conventional x86 processors.
Morpheus was developed as part of a DARPA-funded project. Some 580 experts attempted to hack a medical database by injecting code into the underlying machine. Despite burning 13,000 hours collectively in an effort to hack the system, the effort failed.
“Today’s approach of eliminating security bugs one by one is a losing game,” said Todd Austin, professor of computer science and engineering at the University of Michigan. “People are constantly writing code, and as long as there is new code, there will be new bugs and security vulnerabilities…With MORPHEUS, even if a hacker finds a bug, the information needed to exploit it vanishes 50 milliseconds later. It’s perhaps the closest thing to a future-proof secure system.”
Morpheus was implemented using the gem5 simulator on a Xilinx FPGA and simulates a MinorCPU 4-stage in-order core running at 2.5GHz with a 32KB L1i and 32KB L1d. The L2 cache was 256KB. This is not a high-performance x86 CPU you can run out and buy, in other words.
According to Austin, his research team at the University of Michigan focused on making Morpheus a difficult target for any CPU-targeting exploit rather than focusing on building a chip that could defeat a specific class of exploits. The question was, how do you hide critical information from the attacker, without screwing up what the programmer is attempting to do — namely, write effective code?
The Morpheus FPGA. Image credit: Todd Austin
Austin’s team settled on the idea of obfuscating a class of data known as “undefined semantics.” Undefined semantics are pieces of information the end-user or programmer doesn’t need to know in order to operate a system. Austin uses the analogy of driving a car. To drive a vehicle, you need to know how to operate the steering wheel, the gearshift, and the pedals. You do not need to know how much horsepower the engine makes, or whether the car is using synthetic or standard oil, or what brand of antifreeze is in the engine. These types of traits, according to Austin, are the undefined semantics of the vehicle.
Morpheus achieves this by encrypting memory pointers every 100 milliseconds, over and over again. By continually encrypting data, the project denies attackers the time window they’d need to successfully launch an attack in the first place. Austin refers to this as attempting to solve a Rubik’s Cube that rearranges itself every time you blink. The performance penalty for this kind of encryption, according to the team, is about 10 percent.
The Morpheus design team refers to this constant pointer encryption scheme as “churn,” and they’ve measured the performance impact:
At 100ms, the performance impact is minimal. As the churn speed increases, so does the performance impact, but even churning every 50ms keeps the performance hit tolerable in the average case. The worst-case impact is higher, but this isn’t a CPU that’s ever going to be running SPEC in the first place, so we’d have to see the impact of such a scheme on higher performance chips before drawing firm conclusions.
As Austin notes, this memory encryption approach doesn’t stop every kind of attack you can launch against a system. High-level attacks like SQL injection and man-in-the-middle webserver attacks would still work perfectly. Spearphishing techniques that target people would be completely unaffected. The work presented here, meanwhile, does not offer a simple onboarding method to allow Intel and AMD to take advantage of it.
Still, Morpheus suggests that better protection from side-channel attacks is possible — and end-users might be willing to trade 5-10 percent of theoretical performance in exchange for the security of knowing they won’t be hit with mid-cycle updates that remove that much performance anyway. It should be noted that while Morpheus is being called “unhackable” in certain publications, Austin himself disputes that view, telling IEEE Spectrum: “I think it is hackable. But it’s super hard to hack.”
Now Read:
- Intel, Researchers Debate Whether New Spectre-Type Vulnerabilities Exist
- AMD Discloses a Spectre-Like Vulnerability in Zen 3 CPUs
- Security Disclosures on Theoretical Intel CPU Flaws Are Becoming Ridiculous
No comments:
Post a Comment