PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A few notes on AWS Nitro Enclaves: Attack surface

blog.trailofbits.com | blog | #cloud | #cloud-security | #aws | #confidential-computing | #side-channel | #nitro-enclaves | #attestation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits maps the attack surface of AWS Nitro Enclaves, covering vsock pitfalls, randomness, side channels, memory, time sources, and attestation, with guidance for hardening deployments.
Published
Collected

Related coverage

blog · blog.trailofbits.com
A few notes on AWS Nitro Enclaves: KMS integration
The third post in Trail of Bits' Nitro Enclaves series catalogs passive and active attacks against the enclave-KMS channel, plus operational risks that persist even when cryptography is correct.
blog · blog.trailofbits.com
A few notes on AWS Nitro Enclaves: Images and attestation
Trail of Bits digs into AWS Nitro Enclaves EIF images and attestation, mapping implicit trust relationships and sharing recommendations to avoid security footguns in enclave builds.
blog · vercel.com
Mitigating Denial of Wallet risks with Vercel
Protect against Denial of Wallet (DoW) attacks with Vercel. DoW exploits cloud scalability to inflate costs. Vercel provides solutions like budget alerts, spend limits, and anomaly detection to safeguard workloads and maintain financial stability.
blog · vercel.com
Introducing Vercel Firewall and Vercel Secure Compute
Vercel Secure Compute and Vercel Firewall for enhanced protection of your applications on the frontend cloud
blog · blog.trailofbits.com
Don't let TEEs break your MPC
Combining threshold signatures with trusted execution environments (TEEs) can strengthen MPC deployments, if the TEE serves as a defense-in-depth layer rather than a substitute for a sound protocol.
blog · blog.trailofbits.com
Vulnerabilities in LUKS2 disk encryption for confidential VMs
New LUKS2 flaws (CVE-2025-59054, CVE-2025-58356) affect eight confidential VM systems: malleable headers let disk-level attackers trick TEE guests into encrypting secrets with a null cipher.
Back