Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Signal’s Contact Discovery Service lets users learn which of their contacts use Signal without revealing their address book to the service. To do this, queries are processed on attested Intel SGX enclaves, meaning the contents cannot be read by the server operator. In theory, this sounds secure, but there can still be implementation bugs. Signal runs these services on SGX hardware on Azure but the code is open source.

The host machine cannot directly access enclave memory or modify trusted code. However, it can interact with the enclave. The host can still do weird things like change page-permission bits, cause page faults, and more on the system.

Signal uses a shared memory service to prevent various side channels. To handle these requests, a FIFO queue is used for a long-running worker. The normal flow is as follows:

1. Lookup requested on the enclave.
2. Result is written to memory. Can be read out.
3. Wait time is consumed.
4. Buffer is freed.

The host can start this thread with enclave_run_shard(). However, there's no check for this thread being a singleton! Thus, the worker can be duplicated to violate the correctness of the flow described above. For instance:

1. Worker A starts the lookup.
2. Worker B consumes the wait to free the buffer.
3. Worker A writes back to the freed buffer.

There is one more note on how this happens: how can we guarantee this order of operations? The host has good control over it.

Using the stale write primitive can be turned into a read primitive. By writing into a user response, it's possible to leak the written data in the packet that's read. To actually leak the data, they use use-after-free to corrupt a function pointer to memcpy() to read the enclave key to an outbound packet. Once you have the key, you can impersonate the enclave.

To me, the impact remains limited with Signal. It requires getting access to the Signal box that holds the addresses. The malicious-host attack vector is cool but still requires a lot of work to get to. Overall, a great post on a tricky threat model, and a cool bug!