Security researchers out of the University of Birmingham have crafted another attack against Intel Software Guard Extensions (SGX) when having physical motherboard access and using their "VoltPillager" hardware device they assembled for about $30 USD.

Two years ago

was widely publicized for compromising Intel's SGX security by manipulating the CPU frequency/voltage as able to through software interfaces. By carefully undervolting the Intel CPUs when executing enclave computations they were able to ultimately compromise the integrity of SGX.

Pre-pandemic FOSDEM... Continually one of the best Linux/FLOSS events over the years.

The impact of Plundervolt was already limited as typically the software needs root/administrative rights to access the CPU voltage/frequency MSRs or other kernel interfaces for manipulating them. But in response to Plundervolt, motherboard vendors began offering options to allow disabling voltage/frequency interface controls on their systems. Following Plundervolt, security researchers at the University of Birmingham in the UK began exploring a hardware-based attack on SGX.

With the assembled "Voltpillager" device and latching onto the motherboard's VR responsible for the CPU voltage, they were able to mount fault-injection attacks to again break the integrity of SGX. With this ~$30 device they were able to run proof-of-concept attacks against crypto algorithms within SGX. Yes, this is a sophisticated attack and not as easy as say plugging in a compromised USB/Thunderbolt device with the Voltpillager needing to be carefully attached to the proper voltage regulator, but researchers have found this method to be successful even with Plundervolt safeguards enabled.

This VoltPillager device is based on a Teensy microcontroller. The researchers behind this effort are formally presenting their research at the Usenix Security 2021 conference in August, but this weekend at the virtual FOSDEM conference their findings were shared as well. Their pre-publication paper on VoltPillager was published last November and can be found via

but at the time didn't receive much attention.

As for this weekend's FOSDEM Online event, see

(PDF) for those interested in VoltPillager for their hardware-based under-volting attack on Intel SGX.

If it's not clear enough already, VoltPillager requires obvious hardware access to the system's motherboard and to carefully attach it to the proper VR for a particular motherboard -- so even while Plundervolt's scope was limited in needing root/admin access to the local system, VoltPillager is much more limited. Per the FOSDEM presentation, Intel responded to the researchers that tampering with the internal hardware to compromise SGX is "out of scope for SGX threat model" and prior Plundervolt mitigations were not designed for hardware-based attacks.

More of the VoltPillager research can be found on

.