Confidential VMs just lost the argument they were built to win.

AMD SEV-SNP was the pitch every cloud buyer wanted: encrypt guest memory so a hostile hypervisor stays blind. Two attacks published this week, Mior and Skyfall, let a rogue cloud host read data inside those protected machines. Cybersecurity teams that treated confidential computing as a substitute for host trust now have a research-grade counterexample.

The researchers put the prerequisite in plain language. Both attacks need control of the server’s hypervisor. Mior also needs the BIOS. That’s a high bar for a noisy brute-force against a guest login page. It’s an ordinary bar for a stolen cloud-admin session, a host-stack implant, or a state shop that already sits in the rack.

Mior does more than read. It can change a VM’s memory and fake the signed report that’s supposed to prove which software the guest runs. If your pipeline treats that attestation blob as gospel, you’ve been verifying a document the hostile host can now write.

Attestation is a claim you can now forge from the host.

SaaS decks still say the provider can’t see your data. That sentence was always a contract, wrapped in a CPU feature. Mior turns the CPU feature into something an already-privileged host can narrate. If your risk register listed cloud-operator blindness as a closed item, reopen it.

Rogue hosts read encrypted guests

SEV-SNP sold a hardware promise that the operator of the box couldn’t peek. Skyfall and Mior break that promise once the operator, or anyone who stole the operator’s seat, is already on the metal.

Your threat-protection budget still belongs on the management plane that boots these hosts. The interesting traffic is iLO, iDRAC, the cluster API, the BIOS update channel, and the identity that can live-migrate a confidential VM onto hardware you don’t actually control. A guest-facing firewall does useful work. It doesn’t see a hypervisor admin who never touches the guest NIC.

A German legal change this week makes that diagram less theoretical. The Bundestag passed the biggest overhaul of the country’s spy laws of the postwar era, 308 votes to 190 with 71 abstentions, and handed intelligence services expanded hacking and sabotage powers.

Update the threat model.

Lawful intercept and a criminal who owns the hypervisor share a method: get on the host, then argue with the guest’s cryptography. Cloud buyers in regulated industries love this chip feature because it lets them tell an auditor the hyperscaler is out of the data path. You should answer with who can flash BIOS, who can sit on the hypervisor, and what happens when those people are compelled. The German bill is one jurisdiction. The method travels.

If the hypervisor is in scope, guest memory encryption buys you time, not a verdict.

Known gaps outran the kill switch

Binance’s latest breach reporting rhymes with the same failure. Attackers went after a known weakness and missing controls. Once they were in, attacker-deployed sweepers raced the exchange’s own containment. The controls meant to limit damage after a compromise couldn’t keep pace with drainers that empty wallets faster than incident response can freeze them.

The same lesson applies outside crypto. Your confidential VM, your hot wallet, and your break-glass jumphost all bet that after the first control fails, a second control still has time to work. Sweepers are the proof that time is the asset the attacker buys first.

Look at your own freeze path with a stopwatch. If containment requires a ticket on the same control plane an attacker already holds, you built a sweeper’s favorite architecture. Withdrawal allowlists, delayed settlement, and out-of-band kill switches have to fail independently of the box that got popped. That’s the exchange version of keeping keys off the guest.

Defense in depth only counts if each layer fails independently. A guest that encrypts RAM and then stores the only copy of the key in that RAM has one layer with a better slide deck.

Cybersecurity still requires host custody

Treat confidential computing as one control in a cyber security program, not the program. The operator work below is vendor-neutral and overdue this week.

• Immediate: Inventory every workload you labeled confidential or attested. Write down which keys, tokens, and datasets live only in guest RAM.
• Immediate: Shrink hypervisor and BIOS admin to a named handful of people and break-glass identities. Hardware keys. Sessions logged somewhere the host can’t edit.
• Immediate: Pin measurements yourself. A green attestation from the same console that would be lying is not evidence.
• Ongoing: Keep application-layer keys off the guest in full. Split them. Park the root in an HSM or a KMS on a separate trust domain.
• Ongoing: Hunt the management plane: new BMC users, BIOS diffs, unexpected PXE, hypervisor API tokens. Threat detection belongs there first.
• Ongoing: Rehearse incident response as if the hypervisor is already lost. Revoke keys, rotate wallet authorities, and cut egress without waiting for a clean attestation. Security hardening of guests still matters. Host custody is the control that failed.

Buy confidential computing for the attacker it actually slows: a co-tenant, a sloppy operator who lacks BIOS and hypervisor control, a smash-and-grab on the guest OS. Don’t buy it as a way to stop caring who runs the box. Mior and Skyfall made that bargain public. Your job is to stop signing it.

Sources

• New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
• Attackers in Binance Breach Targeted Known Weakness, Missing Controls
• German parliament passes law giving spy agencies hacking, sabotage powers