Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

End of Bibblio RCM includes -->

Processor Morphs Its Architecture to Make Hacking Really Hard

Researchers create a processor that uses encryption to modify its memory architecture during runtime, making it very difficult for hackers to exploit memory-based vulnerabilities.

Exploiting memory leaks, injecting code into processes, and a variety of side-channel attacks could become much more difficult to pull off if a technique for creating a "morphable" processor architecture gains widespread adoption. 

The research effort, known as Morpheus, is a set of architectural changes to processors that implement two protections: the randomization of processor elements critical to program execution and the periodic encryption of those elements, a process called "churn." The first technique allows a processor to change its architecture, forcing attackers to reverse engineer such changes before exploiting a vulnerability. The second technique changes the architecture quickly enough to prevent attackers from successfully reverse engineering its execution.

Related Content:

DARPA Launches Bug Bounty Program

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: Name That Edge Toon: In Tow

The new architecture could help interrupt the infinite cycle of vulnerability discovery and patching by making vulnerabilities less useful, says Todd Austin, a professor of electrical engineering and computer science at the University of Michigan and a leader of the Morpheus project.

"The vast majority of work in the computer-science space is 'how do I find and how do I fix vulnerabilities?'" he says. "We are on the other side. Our technology recognizes that an exploit is different than a vulnerability, so we ask, 'what are the juicy bits that attackers want to get access to after they have found a vulnerability?" — that's pointers, code, address space, organization, and a variety of other things, and those are what we encrypt."

The multiuniversity effort, whose team also includes members from Princeton University and the University of Texas at Austin, is part of a program run by the Defense Advanced Research Projects Agency (DARPA) and its System Security Integration Through Hardware and Firmware (SSITH) program. Between last July and October, the SSITH group ran a bug bounty contest — and in keeping with the Star Wars theme, called it Finding Exploits to Thwart Tampering (FETT) — pitting almost 600 hackers against various processor designs. 

Each platform had to implement the open source processor instruction set RISC-V while running software with known vulnerabilities. The red teams — composed of both government and freelance hackers — did not have to find vulnerabilities but find ways to exploit known vulnerabilities on the hardware platforms. While the attackers found 10 vulnerabilities in various candidate architectures, Morpheus is among the designs that repelled all attacks.

"FETT challenged performers and greatly matured the architectures in development," Keith Rebello, the DARPA program manager leading SSITH and FETT initiatives, said in a statement earlier this year. "Several of the research teams were driven to document the use and benefits of their security frameworks in a rigorous and understandable way, which will ultimately help third parties understand and adopt these secure processors for operational use."

The researchers noted that attackers will often make use of undefined semantics — places in the program where the behavior of the code is not defined, such as buffer overflows and return-oriented programming. The Morpheus project identified these undefined semantics and created sets, or an ensemble, of moving-target defenses (EMTDs) to protect against them. On a regular basis, then, the processors encrypts the pointers to the EMTDs, essentially creating a new memory architecture about which the attacker has no information — a process called "churn."

Originally, the researchers rekeyed every 100 milliseconds, causing significant processor overhead — up to 10%. In the processor created for DARPA test last summer, the researchers extended the churn cycle to seconds, cutting the overhead to less than 2%.

"What churn mechanism does is it rekeys all the defenses so that any probing or reverse engineering or side channeling that happens, basically all that progress is lost," he says. "Realistically, unless they are going to mechanize their attacks, it is pretty difficult for a human to work through the problem in under a minute."

The researchers have improved their design and will release a second architecture, Morpheus 2, in a future paper. 

The technology uses an encryption process developed by the National Security Agency known as SIMON, a lightweight block cipher that is specifically intended for Internet of Things devices to run quickly in hardware. While significant controversy has swirled around SIMON and a second cipher, SPECK, after the International Standards Organization (ISO) rejected them in 2018, the use of SIMON in the Morpheus processor design only requires the cipher to protect data for less than a minute, under the current specifications.

The proliferation of the Internet of Things devices, which are often not able to run extensive software security code, means that much of the security for these lightweight systems will have to be on the processor. 

The Morpheus architecture, as well as other processor designs that survived the FETT contest, should protect against exploits such as buffer errors, privilege escalations, resource management attacks, information leakage attacks, numeric errors, code injection attacks, and cryptographic attacks.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent t...
PUBLISHED: 2023-05-26
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the re...
PUBLISHED: 2023-05-26
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
PUBLISHED: 2023-05-26
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous ses...
PUBLISHED: 2023-05-26
NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to malicious pages.