Ankura CTIX FLASH Update - May 10, 2024

Ransomware/Malware Activity:

New Pathfinder Attack Can Recover Encryption Keys and Data

Researchers from the University of California San Diego, Purdue University, UNC Chapel Hill, Georgia Institute of Technology, and Google have uncovered two (2) new attack methods targeting high-performance Intel Core Processing Units (CPUs), collectively named "Pathfinder".

These methods exploit vulnerabilities in the branch predictor, particularly the Path History Register (PHR), to launch attacks that can reconstruct a program's control flow history or execute high-resolution Spectre attacks. Spectre attacks utilize branch prediction and speculative execution to bypass application isolation protections and access privileged data. The new techniques enable attackers to manipulate the PHR and the prediction history tables, leaking historical execution data and potentially allowing them to recover AES encryption keys or extract secret images processed by libraries such as