SECTRS @ ETH Zurich

Secure & Trustworthy Systems Group @CSatETH @ETH Zürich.
Led by Shweta Shinde @shw3ta_shinde

[Shweta Shinde @shw3ta_shinde]

We provide an overview of this new family of attacks
https://t.co/IcHsxM69Mx
Track CVE-2024-25742, CVE-2024-25743, CVE-2024-25744 for more updates on fixes and patches

A fantastic effort by @sectrs_ethz team: @BenedictSchluet @SuprajaSridhara @andrinbertschi @Zauney

[Shweta Shinde @shw3ta_shinde]

Our second attack #WeSee to appear @IEEESSP breaks AMD SEV-SNP by sending an interrupt specially introduced for SEV. Starting from a kernel read to arbitrary code injection, we gain a root shell.
Details & Demo at
https://t.co/DWLEATKnt9

[Shweta Shinde @shw3ta_shinde]

Our first attack #Heckler to appear @USENIXSecurity breaks Intel TDX and AMD SEV-SNP by sending interrupts that trigger existing handlers to change the register state and variables in userspace. We break sshd, sudo, and other apps
Details & Demo at https://t.co/5QQmANpTSy

[Shweta Shinde @shw3ta_shinde]

Can a malicious cloud provider send bad notifications to break confidential VMs?
Disclosing #AhoiAttacks that break confidential computing offered by AMD SEV-SNP and Intel TDX by abusing interrupt delivery.
Check our @USENIXSecurity & @IEEESSP papers.
https://t.co/wxr7rBWX7U

[Shweta Shinde @shw3ta_shinde]

It's rewarding that our secure smartphone efforts are gaining recognition on a broader platform.

Proud of the whole team: Friederike Groschupp, @Mark_Ku96, Moritz Schneider, @dn0sar, @SrdjanCapkun

#cybersecurity #ETHZ #swisscybersecuritydays #scsd24

[SECTRS @ ETH Zurich @sectrs_ethz]

Shout out to the Acai team! Supraja Sridhara , @andrinbertschi, @Zauney, @BenedictSchluet, Fabio Aliberti

[Shweta Shinde @shw3ta_shinde]

Had a great time presenting our latest work, Acai, at the ZTHA workshop.

Acai enhances Arm CCA, enabling confidential VMs to securely use accelerators like GPUs & FPGAs.

Check our Usenix Security'24 paper: https://t.co/94k83zw336

Acai is open source: https://t.co/AOxBpZTHl8

[SECTRS @ ETH Zurich @sectrs_ethz]

Read about our group's recent work by @Mark_Ku96 and @shw3ta_shinde

[Shweta Shinde @shw3ta_shinde]

Do users have complete control over their smartphone?
Apple and Google cite technical reasons to control what users, developers, and governments can do on phones.
We are building Sovereign Smartphones to address this.
A recent article explains our work:
https://t.co/GwtyZXjcsR

[ETH CS Department @CSatETH]

Thank you @shw3ta_shinde for yesterday's insightful inaugural lecture titled “Trust, but Verify: Building the Foundations for Secure Software”. Watch the recording here https://t.co/MnSsVOa1Sd @UCBerkeley @NUSingapore @ETH_en #trustedcomputing #systemsecurity #programanalysis

[ETH Zurich @ETH_en]

An international research team whose members include an ETH Zurich professor has revealed a vulnerability in the #SecurityArchitecture of Intel #processors. Until July, Microsoft and Google products were also affected. @CSatETH @NUSingapore https://t.co/WxWqrfGT4a

[Shweta Shinde @shw3ta_shinde]

We have released the details of our upcoming @acm_ccs 2021 paper about a new software attack on SGX

Our attack, SmashEx, exploits reentrancy bugs in enclave exception handling

Check out our webpage for technical details:
https://t.co/BJjoNS9rU8

@jhcui24 @corankyu @prateekatcs

[Shweta Shinde @shw3ta_shinde]

I'm hiring PhD students and postdocs for @sectrs_ethz group. Come join us @CSatETH!