Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Confidential Virtual Machines (CVMs) are Linux-based systems that run in automated environments, handling secrets in an untrusted setting. They run on an untrusted host machine but are interacted with remotely. These are used in applications like private blockchains or multi-party data collaboration. These systems require that the host OS not be able to read memory or modify the the logical operation of the CVM. Additionally, a remote party should be able to confirm that they are running against a genuine CVM program via a remote attestation process.

LUKS2 encryption is used for encrypting the hard drive of the CVM. It contains header information, followed by the actual encrypted volume. The main encryption setting is aes-xts-plain64. The setting cipher_null-ecb is an algorithm that just ignores the key and returns the data unchanged. When the null cipher is used, the key slot can be opened with any passphrase. Effectively, the key phrase is just ignored - in newer versions, the password must be empty in this mode.

This attack enables you to substitute an attacker-controlled drive for the legitimate one.

The threat model is really confusing to me. It's a malicious host attacking a VM that is modifying the VM. If the device is running an OS in a VM, couldn't you change the VM's memory to perform arbitrary actions anyway? Maybe I'm misunderstanding something.