Summary

Hertzbleed is a new family of side-channel attacks. In the worst case, these attacks can allow an attacker to extract cryptographic keys from remote servers running on AMD / Intel processors.

Hertzbleed is a side-channel attack, that is, a way to hack a system without actually hacking the system. Every time you set your computer to run an operation, it creates a certain, very specific, physical signature. Your CPU starts consuming more power to satisfy the requirement, and this CPU throttling is being considered as the root cause analysis for this vulnerability. Unlike more traditional ways to hack information, side-channel attacks rely on these signatures to try to infer what information was being processed. It's like guessing the data based on these signatures.

Hertzbleed is not by any means the first such attack to be discovered. Side-channel attacks have been around for more than two decades at this point. Heartbleed just has a few extra capabilities that haven’t been seen before. Intel says that it doesn't think this attack is practical outside of a lab environment, partially because it takes "hours to days" to steal a cryptographic key. It's a slow attack which would take "hours to days" to steal even small amount of data. So it's very unlikely to be used for any large-scale information theft just yet.

Mitigation

Well, unfortunately, there isn’t much we can do. Hertzbleed has been into existence for some time now, and neither Intel nor AMD has released any patches to or come up with any fixes to mitigate Hertzbleed.

“To our knowledge, Intel and AMD do not plan to deploy any microcode patches to mitigate Hertzbleed”, the researchers note. And frankly, this would not be such a huge problem for most of the computer users. And if you still want to mitigate it, you could use the workaround by the researchers which instructs to disable frequency boost / Turbo boost / Precision boost. This would prevent leakage via Hertzbleed.

Resources

Information Disclosure through side-channel attacks - Hertzbleed
• https://www.hertzbleed.com/

Authors: Narendra Kumawat, Mahesh Saptarshi

For more information contact:contact@cybersecurist.com