Intel and AMD CPU’s Hertzbleed Vulnerability Can Help Hackers Steal Crypto Keys
Researchers from UT Austin, UIUC, and UW published papers today outlining how malicious players can steal crypto keys on AMD and Intel processors using a side-channel vulnerability attack known as ‘Hertzbleed.’ According to researchers, hackers can steal secret AES cryptographic keys by monitoring the CPU’s power mechanisms and boost frequency.
Hertzbleed Vulnerability Could Serve as a Crypto Hacking Route
Intel says it discovered this vulnerability via internal security investigations. External teams later disclosed their findings to the company. Today’s disclosure brings the issue to the public. Likely, CPUs from other companies are also affected.
Both chip giants Intel and AMD CPUs are affected. These include laptop models and Intel desktops from 8th to the 11th generation core microarchitecture and AMD Ryzen chips desktop and laptop models from Zen 2 and Zen 3 microarchitecture.
Both AMD and Intel have issued advisories concerning the issue.
How Hertzbleed Attack Works
Hertzbleed is a chip vulnerability allowing side-channel attacks. According to the report, this attack steals data by observing the impact of an operation on a system. The attack monitors the energy impression of any particular cryptographic workload because power signatures vary on different systems.
Hertzbleed can steal secure data that normally remains encrypted. By observing the power information generated by your CPU, hackers can convert that information to timing data. This opens doors for them to steal cryptographic keys. The scary part is that Hertzbleed does not require physical access. It can be used remotely.
Modern processors from other vendors are likely to be exposed to this vulnerability. According to the researchers, Hertzbleed tracks the algorithms of power behind the Dynamic Voltage Frequency Scaling (DVFS) technique. Most modern processors use DVFS, and thus other manufacturers like ARM are likely affected.
This situation paints a worrying picture since many users are affected by Hertzbleed. There is no quick fix to be safe from it at the moment. However, Intel has come up with a solution to prevent its users from falling victim to Hertzbleed.
How to Avoid Hertzbleed Vulnerability
You are probably secure even without doing anything. If you want to play it safe, you can take steps. Intel has provided some mitigation methods against Hertzbleed. These companies don’t seem to be planning to deploy any firmware updates.
Intel guidelines give two ways to be fully protected from Hertzbleed. One is disabling Turbo boost on Intel processors and Precision Boost on AMD CPUs. In both cases, a trip to the BIOS is required and disabling boost mode. Unfortunately, it would seriously affect your processor’s performance. The other method is either very difficult, if not impossible or only results in partial protection.
Keep your eyes open and stay sharp. Cybersecurity attacks always happen; it’s good to be extra careful.
According to Intel Senior Director of Security Communications and Incident Response Jerry Bryant, stealing a crypto key takes a few hours to a few days; the attack is not practical outside a lab environment.
