  AMD SEV is a hardware extension for main memory encryption on multi-tenant
systems. SEV uses an on-chip coprocessor, the AMD Secure Processor, to
transparently encrypt virtual machine memory with individual, ephemeral keys
never leaving the coprocessor. The goal is to protect the confidentiality of
the tenants' memory from a malicious or compromised hypervisor and from memory
attacks, for instance via cold boot or DMA. The SEVered attack has shown that
it is nevertheless possible for a hypervisor to extract memory in plaintext
from SEV-encrypted virtual machines without access to their encryption keys.
However, the encryption impedes traditional virtual machine introspection
techniques from locating secrets in memory prior to extraction. This can
require the extraction of large amounts of memory to retrieve specific secrets
and thus result in a time-consuming, obvious attack. We present an approach
that allows a malicious hypervisor quick identification and theft of secrets,
such as TLS, SSH or FDE keys, from encrypted virtual machines on current SEV
hardware. We first observe activities of a virtual machine from within the
hypervisor in order to infer the memory regions most likely to contain the
secrets. Then, we systematically extract those memory regions and analyze their
contents on-the-fly. This allows for the efficient retrieval of targeted
secrets, strongly increasing the chances of a fast, robust and stealthy theft.
