Another vulnerability and exploit named VoltPillager has been published for Intel Corporation's SGX security technology.  The attack itself is simply a hardware version of a previously discovered PlunderVolt software vulnerability where voltage to the chip was manipulated to undermine SGX enclave protections.  PlunderVolt was able to recover secret information like encryption keys from Intel’s hardened security SGX vault, but a patch has been released to close the risks.  However, VoltPillager bypasses that patch by directly manipulating voltage on the hardware itself.

The hardware to accomplish this feat is very inexpensive, coming in at around $36.  It does however require physical access to the motherboard to install the hardware hacking device. 

This is where the most disturbing aspect of this narrative emerges: pure denial by Intel.  Intel has apparently stated to news outlets and the vulnerability researchers that they don’t consider this a vulnerability because, according to Intel, they aren’t responsible for whatever happens if someone opens the case of a PC or server.  Therefore, it appears they have no intentions of fixing something they choose to not classify as a vulnerability.

How convenient!  Avoid dealing with the problem by saying it isn't a problem.

Once again it appears that Intel’s legal and marketing teams are in control of security policy.  This is a classic denial of responsibility. 

The simple fact is that SGX has one purpose: to be a secure vault embedded in Intel’s chips.  That vault has been cracked.  It does not matter how, it is Intel’s responsibility.

Dodging accountability speaks volumes to how any organization views, invests, and handles product security. 

Step up.  If your super-secret SGX vault is being cracked, then it does not matter how.  Own it and figure out mitigations. 

As a shareholder and cybersecurity expert, I am gravely disappointed!

This is security, not a marketing spin-control exercise or avoid-the-liability legal game.  It is time to replace the leadership that is allowing lawyers and marketeers to define your product security policy.  You are losing valuable trust with your customers and undermining the confidence in digital technology adoption.

E-mail me when people leave their comments –

CISO and Cybersecurity Strategist

You need to be a member of CISO Platform to add comments!

Join CISO Platform

CISO Platform

A global community of 5K+ Senior IT Security executives and 40K+ subscribers with the vision of meaningful collaboration, knowledge, and intelligence sharing to fight the growing cyber security threats.

Join CISO Community Share Your Knowledge (Post A Blog)
 

 

 

City Round Table Meetup - Mumbai, Bangalore, Delhi, Chennai, Pune, Kolkata

  • Description:
    CISO Playbook Round Table Overview : 
    Our round tables are designed to bring together top CISOs and IT leaders in intimate, focused sessions. These closed-door discussions will provide a platform to explore key security challenges and solutions. These sessions aim to create a focused, closed-door environment where 08-10 CISOs will dive deeply into the practicalities of implementing specific technologies.
    • Technology Implementation: From…
  • Created by: Biswajit Banerjee
  • Tags: ciso, playbook, round table

CISO Cocktail Reception At RSAConference USA, San Francisco 2025 !

  • Description:

    We are excited to invite you to the CISO Cocktail Reception if you are there at the RSA Conference USA, San Francisco 2025. It will be hosted aboard a private yacht, so that our CISO's can enjoy the beautiful San Francisco skyline while cruising the Bay Area! This event is organized by EC-Council with CISOPlatform and FireCompass as proud community partners. 

    Yacht Party…

  • Created by: Biswajit Banerjee
  • Tags: ciso, usa, san francisco, rsaconference 2025

Round Table Dubai 2025 | GISEC

  • Description:
    CISO Playbook Round Table Overview : 

    Our round tables are designed to bring together top CISOs and IT leaders in intimate, focused sessions. These closed-door discussions will provide a platform to explore key security challenges and solutions. These sessions aim to create a focused, closed-door environment where 08-10 CISOs will dive deeply into the practicalities of implementing specific technologies.
    • Technology…
  • Created by: Biswajit Banerjee

CISO Platform: CISO 100 Awards & Future CISO Awards | In association with EC Council

  • Description:

    Nominate for the CISOPlatform CISO 100 Awards & Future CISO Awards - Recognizing Cybersecurity Leaders. Recommend someone you know deserving of this prestigious accolade....Nominate your colleague, mentor, someone you admire or yourself !

    For more details: Click Here…

  • Created by: Biswajit Banerjee