Category: Microsoft Tools

A security vulnerability that affects Windows computers running on 64-bit Intel and AMD processors could give an attacker access to your passwords, private conversations, and any other information within the operating system kernel memory. Users are advised to update Windows in order to mitigate against this new CPU “SWAPGS attack” risk.

What is the SWAPGS attack?

“We call this the SWAPGS attack because the vulnerability leverages the SWAPGS instruction,” Bogdan Botezatu, director of threat research and reporting at Bitdefender, says “an under-documented instruction that makes the switch between user-owned memory and kernel memory.” Botezatu also says that, at this point, “all Intel CPUs manufactured between 2012 and today are vulnerable to the SWAPGS attack.” Which means every Intel chip going back to the “Ivy Bridge” processor is vulnerable if inside a machine running Windows.

However, it appears it is not just Intel CPUs that are affected by the SWAPGS attack vulnerability. According to a Red Hat advisory published August 6^th, the threat “applies to x86-64 systems using either Intel or AMD processors.” Something that AMD itself disputes.

An AMD spokesperson pointed me in the direction of a public statement online: “AMD is aware of new research claiming new speculative execution attacks that may allow access to privileged kernel data. Based on external and internal analysis, AMD believes it is not vulnerable to the SWAPGS variant attacks because AMD products are designed not to speculate on the new GS value following a speculative SWAPGS. For the attack that is not a SWAPGS variant, the mitigation is to implement our existing recommendations for Spectre variant 1.”

That same Red Hat advisory stated that “based on industry feedback, we are not aware of any known way to exploit this vulnerability on Linux kernel-based systems.” During my briefing with Botezatu, he noted that “Linux machines are also impacted,” however, due to the operating system architecture they are “less prone to this type of attack, as it is less reliable.” Botezatu says that other operating system vendors are not impacted at this point, “but are still investigating similar attack avenues leveraging the SWAPGS attack.”

As already mentioned, Bitdefender researchers have been working with Intel for more than a year to address the risk from this new “side-channel” attack that, the company said, “bypasses all known mitigations implemented after the discovery of Spectre and Meltdown in early 2018.”

However, it has waited until now to disclose the information as Microsoft has issued a fix to address the vulnerability as part of the July 9 “Patch Tuesday” updates. Even so, despite the best efforts of everyone concerned, Bitdefender admitted that “it is possible that an attacker with knowledge of the vulnerability could have exploited it to steal confidential information.”

A Microsoft spokesperson provided me with the following statement: “We’re aware of this industry-wide issue and have been working closely with affected chip manufacturers and industry partners to develop and test mitigations to protect our customers. We released security updates in July, and customers who have Windows Update enabled and applied the security updates are protected automatically.”

I understand that as soon as Microsoft became aware of the issue, it worked quickly to address it and release an update as soon as possible. Microsoft works closely with both researchers and industry partners to make customers more secure, and as such did not publish details until August 6 as part of a coordinated vulnerability disclosure.

Red Hat has stated that “there is no known complete mitigation other than updating the kernel and rebooting the system. This kernel patch builds on existing Spectre mitigations from previous updates.”

So, to address the issue for Linux machines requires updates to the Linux kernel in combination with microcode updates. “Red Hat customers running affected versions of the Red Hat products are strongly recommended to update them as soon as errata are available,” Red Hat advises, “customers are urged to apply the appropriate updates immediately and reboot to mitigate this flaw correctly.”

Meanwhile, an Intel spokesperson provided the following statement via email:

“On August 6th, researchers from Bitdefender published a paper entitled “Security Implications of Speculatively Executing Segmentation Related Instructions on Intel CPUs.” As stated in their paper, Intel expects that exploits described by the researchers are addressed through the use of existing mitigation techniques. We believe strongly in the value of coordinated disclosure and value our partnership with the research community. As a best practice, we continue to encourage everyone to keep their systems up-to-date.”

How is the SWAPGS attack related to Spectre?

Like the Spectre vulnerability which dominated the headlines for so long, this new side-channel exploit takes advantage of the speculative execution functionality of modern processors. Simply put, that functionality speeds up the CPU by enabling it to make a bunch of educated guesses as to the instructions that will come at it next. Thomas Brewster has a good primer on these side-channel attacks in this Forbes article from May 22, 2018.

Where SWAPGS differs is in the attack methodology as it combines that speculative execution of instructions with the use of that previously mentioned SWAPGS instruction by Windows operating systems within a gadget.

How easily can this attack be executed?

The chances of falling victim to a SWAPGS attack now that the details have been disclosed have increased, so users are advised to apply available updates as a matter of urgency if they have not already done so. However, it should be remembered that, as Botezatu admits, “this is not your run of the mill attack against regular computers, as running the SWAPGS attack is time-consuming.”

Your average threat actor would instead rely on lucrative, and easy to execute, attack methodologies such as phishing. “On the other side, exploiting this bug from a threat actor perspective brings significant advantages,” Botezatu warns “it circumvents anti-malware defenses and would leave no traces on the compromised system.”

The scary firmware attack surface explained

Ian Thornton Trump, head of cybersecurity at Amtrust International, knows what this “BIOS and firmware” attack surface looks like. “To understand why it’s so scary comes down to one simple concept,” Thornton-Trump tells me, “if the firmware, BIOS and microcode layers of a computer are insecure than it is impossible to put a secure operating system on top of that.”

Indeed, when the original Spectre threat story first broke, I recall Thornton-Trump speculating that the modern CPU is actually an operating system unto itself; concluding that architectural and procedural vulnerabilities will be aggressively explored by security researchers.

“Now we have a new development in this story,” Thornton-Trump says, “inserting code into speculative execution can yield an exploit for a component of the 64-bit Windows Kernel.” What does this mean? “It means the Operating System is no longer secure because the CPU is not secure,” and the result of that is a leak of user mode data.

Which users are at most real-world risk from SWAPGS?

“Criminals with knowledge of these attacks would have the power to uncover the most vital, best-protected information of both companies and private individuals around the world, and the corresponding power to steal, blackmail, sabotage and spy,” Gavin Hill, vice-president for datacenter and network security products at Bitdefender warned.

“I don’t think this is going to be leveraged into a Wannacry or Notpetya level of attack,” Thornton-Trump says, “and I don’t think it will be adopted by cyber-criminals with financial motivations.” These are the sort of vulnerabilities that “Government Cloud” and “Military Mega-Cloud” projects should be aware of, according to Thornton-Trump.  “For people with sensitive data in virtual environments these sorts of exploits need to be considered in the threat model,” he concludes, “for the rest of us, we have far worse issues to deal with.”