WireTap and Battering RAM: attacks on TEEs | Kaspersky official blog
Source Kaspersky Security Blog
Description
WireTap and Battering RAM — two independent theoretical papers — demonstrated the feasibility of attacks on trusted execution environments (TEEs).
Impact
For European organizations, especially those utilizing cloud services, virtualized environments, or on-premises servers employing Intel SGX or AMD SEV for sensitive data protection, these attacks pose a significant risk to confidentiality and integrity. Successful exploitation could lead to unauthorized data disclosure, including cryptographic keys and sensitive workloads, undermining trust in TEEs as a security boundary. The ability to inject malicious code (notably via Battering RAM’s circumvention of SEV-SNP) further threatens system integrity and availability by enabling persistent compromise of virtual machines. Although physical access requirements limit the attack surface, insider threats, supply chain compromises, or targeted attacks on data centers could enable exploitation. The demonstrated reduction in attack cost and increased stealth capabilities increase the likelihood that sophisticated threat actors, including nation-states or advanced cybercriminal groups, might attempt such attacks. The impact is particularly critical for sectors handling highly sensitive data such as finance, healthcare, government, and critical infrastructure. The lack of current exploits in the wild and the focus on DDR4 memory modules somewhat mitigate immediate risk, but organizations must anticipate future developments targeting DDR5 and evolving attack techniques.
Defensive guidance
European organizations should implement layered defenses beyond relying solely on TEEs. Physical security controls must be strengthened to prevent unauthorized hardware access to servers, including tamper-evident seals, surveillance, and strict access policies for data centers. Deploy hardware with DDR5 memory modules where possible, as current attacks target DDR4 architectures. Regularly update and patch firmware and microcode for processors and memory controllers to incorporate vendor mitigations. Employ memory encryption solutions that do not rely on deterministic encryption or that incorporate additional entropy to prevent key derivation from known plaintext attacks. Monitor for anomalous hardware modifications or unexpected memory behavior using hardware attestation and runtime integrity checks. Consider architectural changes such as isolating critical workloads on dedicated hardware or using multi-factor attestation for virtual machines. Engage with cloud providers to understand their physical security and hardware refresh policies, and prefer providers that use newer memory standards and enhanced TEE implementations. Finally, maintain an active threat intelligence program to track developments in TEE vulnerabilities and emerging mitigations.