WireTap Attack Breaks Intel SGX Security

Georgian Tech and Purdue University researchers have demonstrated a passive DIMM interposer technique, named WireTap, that can be used to break Intel SGX’s DCAP attestation mechanism. The attack requires physical access to a server using SGX and relies on an interposer constructed from readily available second-hand electronics for under £1,000.

Once deployed, the interposer slows memory traffic, takes control of the SGX enclave by flushing the cache, and enables extraction of the machine’s attestation key within 45 minutes. The researchers warn that the compromised key can undermine confidentiality guarantees in deployments such as Phala and Secret, where they forged quotes to decrypt contract data, and Crust, where they demonstrated fake proofs of storage to attack network nodes.

The paper notes a device can cheaply inspect memory traffic in basic environments, and that mitigation options include increasing entropy in memory encryption and protecting the attestation quote, with Intel stating that the attack assumes physical access beyond the products’ threat model. According to Intel, the researchers reported findings to Intel and affected deployments earlier this year, and the attack is discussed in a security publication dated 2 October 2025.