Top OpenSSH protects in-memory keys against Specter or Meltdown attacks

 The OpenSSH project has just received a patch that prevents hackers from taking advantage of hardware vulnerabilities that can give them access to unauthorized memory spaces by exploiting unprivileged processes, ultimately stealing private keys. The same approach could be used by other software applications to protect their secrets written in RAM until solutions are found to these problems for future generations of SDRAM chips and CPUs. The patch was released after a team of researchers exposed an attack called RAM Bleed. The latter exploits the design of modern memory modules to extract information from memory spaces dedicated to privileged processes and to the kernel. RAM Bleed uses a software technique called Row hammer to trigger bit jumps inside physical memory cells and retrieve sensitive information through a side channel. The attack carried out by the researchers recovered a 2048-bit RSA signing key from an OpenSSH server using code executed with user-level privileges.

 Modern operating systems isolate the virtual memory allocated to the kernel from the memory of user-space applications. This is because kernel memory contains sensitive data, including encryption keys and passwords. These should be kept out of reach of unprivileged applications. Any violation of this fundamental principle introduces a critical security hole, with attackers having plenty of choices when it comes to obtaining code execution permissions on computer systems. They pass through malware infections or exploit vulnerabilities in many applications running in user space. The attack surface offered by all unprivileged applications running on a computer is much larger than that of the kernel itself.

 OpenSSH patch encrypts private keys.

 The new OpenSSH patch, submitted by OpenBSD developer Damien Miller, “protects private keys at rest in RAM against speculative action and side-channel memory attacks like Specter, Meltdown, Row hammer, and Ram bleed.” Side-channel attacks like Specter, Meltdown, and more recently Micro architectural Data Sampling (MDS), take advantage of the speculative execution feature of modern CPUs, a feature designed to improve performance. Some of these attacks can be used to read protected kernel memory.

 The new OpenSSH patch encrypts private keys when they reside in memory and are not actively in use with another symmetric key derived from 16 KB random data. Before we can attempt to decrypt the protected private key, but that seems unlikely considering all the bit error rates observed in current attacks, Damien Miller explained in his comments to the patch. “From an implementation perspective, at the time of loading, keys are encrypted with protection, and unprotected automatically and transparently when used for signatures or when stored/serialized.”

 A usable or reproducible patch for other software.

 OpenSSH is the most popular implementation of the SSH (Secure Shell) protocol, used to remotely access and manage computer systems and servers, as well as for automated machine-to-machine communications. The protocol was originally designed for OpenBSD, but is also used by default in most current Linux distributions and is supported by Windows 10. The approach used by OpenSSH could be replicated by other software projects to protect their own keys and secrets in memory. However, as the patch notes suggest, this technique reduces the likelihood of successful side-channel attacks, but it doesn’t make them impossible.

 Attack procedures are constantly being improved by hackers, and one can imagine that future variants of RAM Bleed or Meltdown/Specter will manage to counter this mitigation. The underlying design flaws of tomorrow’s hardware will likely be corrected, but replacing the processors and SDRAM chips used today will take many years. It’s best to consider that these hardware attacks, and any future attacks, will have a long-term impact on corporate IT. Anything software developers can do to partially mitigate these flaws and make it harder for hackers to work is extremely helpful. “I think we will be able to solve this problem within a few years and offer a more secure computing architecture,” Miller added.