The piece surveys a series of practical and academic attacks that collectively undermine the security assumptions of trusted execution environments (TEEs). It groups failures into classes: bugs in enclave code (e.g., Signal’s SGX-based contact discovery leaking memory), remote attestation forgery and key-extraction attacks (Foreshadow 2018, SGAxe 2020, ÆPIC Leak 2022), and a recent wave of physical DRAM interposition attacks and memory tampering (BADRAM2, WireTap.fail, TEE.fail, Battering RAM, DDRrop across 2024-2026) that extract or falsify attestation material or enable backdoored VMs. The write-up emphasizes that remote attestation verifiers that accept any “good” CPU can be deceived by an attacker who compromises one platform, and that the only practical defense is tightly pinned PKI management for attestation keys - an operational footgun for most deployments.
It also highlights liveness and availability problems: credential revocations and slow TCB recovery have left enclaves unusable in past incidents, and denial-of-service remains explicitly out of the threat model for many TEEs. Many academic attacks further expand the threat surface. The practical takeaway is blunt: do not place high-value secrets in TEEs unless you accept significant risk or are willing to sacrifice performance and functionality for more principled, lower-level designs.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The Consumer Financial Protection Bureau (CFPB) has launched an investigation into nine large national banks over alleged debanking practices. The inquiry aims to determine whether these banks have unlawfully restricted access to banking services. (forbes.com)
British Airways has updated its rules to prohibit covert filming of employees with Meta smart glasses, warning that doing so can lead to flight cancellation and refusal of service. The airline can also report incidents to authorities if recording without consent is suspected. (liveandletsfly.com)
The EPA has retracted its claim that the US has phased out the toxic PFAS compounds Pfoa and Pfos. Despite recognizing their dangers, the agency continues to permit production and use of these chemicals in certain products. (theguardian.com)
Namecheap has seized and disabled all domains associated with an account, causing disruption. The user reports being blocked and unable to access their domains or account features. (reddit.com)
Python's precompiled binary wheels simplify package installation but pose security risks because attackers can upload malicious binaries that do not match the source code. Analyzing and verifying binary integrity is difficult, making supply chain attacks increasingly likely in the Python ecosystem. (rushter.com)
Microsoft has withdrawn from a major AI datacentre project in Essex due to concerns over power supply stability. The project, led by UK firm Nscale, was expected to be the largest of its kind in the country. (theguardian.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.