Stealing private keys in Google Cloud with Spectre L1TF exploit

8 hours ago

Spectre and Meltdown were the first transient execution vulnerabilities discovered in 2017, affecting CPU microarchitecture.
These vulnerabilities allow attackers to steal data, such as one app stealing from another or a website stealing from another open in the same browser.
Despite eight years of research, the real-world threat of these vulnerabilities remains uncertain due to their complexity and limited attack scenarios.
The 'Rain' project demonstrates the real-world danger of transient execution vulnerabilities by showing how attackers can exploit commercial clouds like AWS or Google Cloud to leak sensitive data.
The exploit 'L1TF Reloaded' combines L1TF and (Half-)Spectre vulnerabilities to leak data from cloud environments, despite existing mitigations.
L1TF Reloaded was demonstrated on KVM-based cloud solutions, leaking information about other customers, their running programs, and even cryptographic keys.
Mitigations for L1TF and Spectre exist but do not eliminate the root causes, leaving partial vulnerabilities like Half-Spectre gadgets still common.
The project includes a paper, code repository, vulnerability disclosures, blogs, and talks detailing the findings and exploits.

Hasty Briefsbeta