NetCAT Vulnerability Is Out of the Bag

A new side-channel vulnerability it out, but this one comes with a twist: Rather than exploiting weaknesses in speculative execution routines within the CPU, the vulnerability — named NetCAT by the researchers who found it — uses performance-enhancing networking capabilities to potentially leak information transmitted during an SSH-protected session.

NetCAT, discovered by Michael Kurth, Ben Gras, Dennis Andriesse, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi, of ETH Zurich, Switzerland, takes advantage of Data-Direct I/O (DDIO), a feature of recent Intel server-grade CPUs that allows peripherals to read/write from/to the fast (last-level) cache. It was introduced to improve performance of servers in high-speed network environments.

With NetCAT, an attacker on a remote system can, by merely sending packets to the targeted server, get information on the arrival timing of packets sent by a third system. After processing that information with statistical routines, an accurate decoding of text being typed on the third system can be created.

Intel has acknowledged the validity of the vulnerability and paid a bounty to the researchers. It recommends customers disable DDIO, which is enabled by default, to mediate the vulnerability.

Read more here and here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Community Projects Highlight Need for Security Volunteers."