The video discusses a newly disclosed hardware attack called Volt Pillager, a cheap ($36) voltage‑manipulation exploit that can extract secrets from Intel's SGX secure enclaves by physically accessing the motherboard. The speaker explains how Volt Pillager builds on the earlier Plundervolt software attack, describes the attack’s low cost and physical‑access requirements, and then sharply criticizes Intel’s public response, which dismissed the attack as “out of scope” of the SGX threat model. Drawing on 24 years of experience at Intel and personal investment in the company, the speaker argues that Intel’s denial is unethical, reflects a misguided security culture dominated by legal and marketing concerns, and undermines trust in the technology. He proposes a constructive response: acknowledge the difficulty of mitigating hardware attacks, collaborate with researchers, explore patches or detection mechanisms, and incorporate lessons into future designs. The video concludes with a broader call for the industry to adopt responsible disclosure practices and prioritize security over liability avoidance, positioning proper handling of such vulnerabilities as a competitive advantage.
Chapters
Another vulnerability to Intel's SGX secure technology has been announced, Volt Pillager. And what's interesting here is not really about the vulnerability. What's most concerning is Intel's response. So let's break it down a little bit. So some researchers came out with what they call Volt Pillager, and this is really a hardware variant of a previous discovered vulnerability in software called, uh, Plundervolt. And what Plundervolt what Plundervolt did is it modified the voltage causing some errors. And that was able to be leveraged to get some secrets out of Intel's SGX technology. And SGX is basically, it's a digital vault. It's a secure enclave that sits within Intel CPUs, and it is specific to Intel. It is their proprietary technology. So a patch was released when Plundervolt came out. So that kind of resolved that. And what the researchers have done is they've created very inexpensive, it's like $36 worth of hardware that can be attached to the system itself. So they gotta get access to the motherboard and the chip. And it does the same thing. It modifies the voltage to again, unlock the secrets within SGX. Okay, there's a lot to think about there. Unfortunately, it's pretty cheap, right? To go do that, you have to have physical access, some other things. But what's most disturbing is Intel's response, both to the vulnerability researchers as well as, as news agencies that have asked about this. Now, let me read this 'cause I wanna get this right. So the researchers indicated that Intel responded that, quote, "Opening the case and tampering with internal hardware to compromise SGX is out of the scope of the SGX threat model." And the Register reported that Intel responded to them by saying, quote, "Techniques that require an attacker to physically open the case, including removing screws or breaking plastic casing to gain access to the internal hardware of the device, is typically not addressed as a vulnerability." What? That's absurd. Think about this. Intel has created a vault. And somebody's cracking this vault. It doesn't matter how. It doesn't matter if a screw's been removed or they're using software or hardware or pixie dust. This is your vault, Intel. Own it. So SGX has only one job, right? It's a secure enclave. It keeps secrets. It runs processes in secure environments, right? Including passwords and authentication and keys all sorts of things. So cracking it has a potential big impact to the users, right? It can release all those big secrets that are supposed to be locked down. And again, doesn't matter whether it's hardware or software. Um, denial and basically saying we're not going to classify that as a vulnerability so we don't have to deal with it, that's denial. That's not security. That's not professional, right? And it gets to the point, it's unethical. This is your vault. Have some ownership. Security by saying, well, I'm just not gonna classify that as a vulnerability, so I'm not gonna do anything about it, that's the wrong path. So let me throw you a bone here, Intel. Let me give you an example, and I'm just making this up, of what a good response might be. How about responding and saying, this type of hardware attack is really tough to mitigate, and it is relevant to the security of our customers. It's important to us. And because of that, we're going to take our brilliant engineers and our security experts, and we're gonna partner with the industry, including these researchers, to figure out what we can do. Let's explore whether there is some kind of patch that we can put in place to disrupt this attack. And if there isn't, let's figure out what type of potential mitigations or detection and alerting or response capabilities that maybe we can work with in our products or within the ecosystem, the operating system, the vendors, whatnot, but we wanna explore it. So we'll work, we'll come back in 60 days, we'll publish our findings in a paper to try and figure out what we can do for this particular issue. In addition, we will take those key learnings as we develop and architect future generations of our products so that this is not an issue. We want our customers to be secure. We want everyone that uses our technology, our Secure Vault, to feel that it's trustworthy. So this is what we're gonna commit to. That would be a whole lot better response than simply saying, that's outside our threat model, so we don't even classify it as a vulnerability. Move it on. The fact that that is their response, right? Think about this. If that is their public response, that means it's embedded in policy. That means their leadership team has looked at it and said, yeah, yeah, that makes sense. That means it's a systemic issue. This is where I have concerns. I worked at Intel for 24 years, incredible company, right? You can't approach security like this. In fact, this is not a security approach. You know who wrote this? Lawyers, marketing people. People that were concerned about, oh, don't, don't say anything that might make us accountable. Let's avoid liability. Oh, don't say anything that might tarnish our brand. Redirect. Deny. Andy Grove and the other founders of the company are— have to be rolling in their graves, as well as the brilliant engineers and technologists who have been part of such a great company for so many years. They have to be shaking their heads. Things like this were a challenge, a technical challenge. Let's go see what we can do, right? Intel has been known for great leadership, technical innovation, engineering magic, not denial. What are you doing, Intel? If this is your leadership around product security, you have the wrong leaders in place. And I'm guessing you have a lot of lawyers, a lot of marketing people, probably a lot of engineers as well that maybe now have security in their title. They're not security experts, none of them, because this is not a security response. And just because you put security in front of your title does not mean you have the expertise. I know brilliant engineers, but they are not security experts. They're not experts in security risks, attacks, or understand the long-term aspects of how to manage those types of risk moving forward. All right, that doesn't take away anything from their expertise in being a project manager or an engineer or an architect, but you need to have the security mentality in there. And I don't know if there's any of them left, not if this is the policy, not if this is what's being stated. Right? It's embarrassing. I'm a stockholder. I still have RSUs. I'm— I want to be an advocate for Intel. I do. But this is wrong. Flat out wrong. Borderline unethical. Fix it. Own it. And if you're another technology company out there, including a competitor of Intel, don't follow this path. This is not the right path. Instead, you should be going the opposite direction, saying no, security of our products, no matter how they're compromised, is important to us. Even if it's a hardware attack, we're going to dedicate, we're gonna learn from what Intel is experiencing and look at our own technology. We're gonna make sure we don't respond this way. We're going to have plans and we're gonna take ownership. And we're gonna make sure that our environment is set up to both design good and strong products, but also be able to respond to all this great intelligence. And we're gonna thank those security researchers who bring this to us, and we wanna work with them so that we can learn and be better at developing products and sustaining them. This will give you an advantage. This is a competitive advantage, and it will be over the companies who don't take it seriously, who answer by saying, we're just not gonna consider that a vulnerability. The security industry will reward you. Your customers will thank you and reward you. Trust will be built. Your partners will appreciate it. This is a competitive advantage. Don't fall into the same pitfall. We all need to do better. Trust in technology, and Intel is an anchor of digital technology. We have to increase trust. Which means we have to address these in a rational way, not through denial.
