Can the proof of elasped time (PoET) consensus algorithm be exploited by multiple nodes? i recently learned about the Hyperledger Blockchain Project and the specific frameworks. In case of the Sawtooth framework, consensus is reached not by PoW but by PoET (Proof of elapsed Time).

When getting familiar with the proof-of-work (PoW) you usually hear that it's safe regarding participant exploits, because of the computation power which would be needed.

In regards of PoET where the leader for making the consensus is elected by the node with the shortest wait time, i am wondering if it would not be possible to exploit the system, when spaming the network with multiple nodes, so it's more likely to become the leader. 

BR
Yes, here's an article stating that "SgxSpectre Attack Can Extract Data from Intel SGX Enclaves". 


  According to researchers, SgxSpectre works because of specific code
  patterns in software libraries that allow developers to add SGX
  support to their apps. Vulnerable SGX development kits include the
  Intel SGX SDK, Rust-SGX, and Graphene-SGX.
  
  Academics say an attacker can leverage the repetitive code execution
  patterns that these SDKs introduce in SGX enclaves and watch for small
  variations of cache size. This is a classic "side-channel attack," and
  is quite effective.


However, Intel stated that an update for the Intel SGX SDK that adds SgxSpectre mitigations will be released on March 16, 2018.

Also, Here's a research paper that does some theoretical analysis on compromising a blockchain network using SgX and finally states that "Yes, it might be possible". 

The title of this paper is "On Security Analysis of Proof-of-Elapsed-Time (PoET)". I'm adding relevant snips of the paper to ensure that in case dead links occur, at least the summary of what they say is available in this post.

The brief of this paper states that 


  "To fulfil this gap, we develop a theoretical framework for evaluating
  a PoET based blockchain system, and show that the current design is
  vulnerable in the sense that an adversary can  jeopardize the
  blockchain system by only compromising Θ(log log n/ log n) fraction of
  the participating nodes, which is very small when n is relatively
  large. 
  
  Based on our theoretical analysis, we also propose methods to mitigate
  these vulnerabilities"


They go on to summarise that there are ways to mitigate these problems.


  
  Changing the probability distribution of F. If the probability distribution F does not rely on n, then adversaries have to compromise
  a a+µ fraction of the nodes in order to compromise the system.
  
  
  Allowing blocks generated by honest mining nodes to be rejected. We assume that the statistical test will not reject a block that is
  generated by an honest node, whereas the adversaries can simulate the
  fastest honest node in the system. It is possible to get beyond the
  threshold of Θ(log log n log n) if we allow the statistical test to
  reject blocks generated by honest users.
  
  


However, it is important to note that this paper does not mention a concrete method to compromise the safety of the PoET algorithm running in an SGX enclave and merely states that 


  "SGX and other trusted computing technologies are not 100% reliable.
  Especially, they may be vulnerable to sophisticated adversaries with
  necessary resources and skillsets."


But given the SGXSpectre attack, it is not an academic question but a practical one .... 

UPDATE: Here's an excellent video titled "34C3 - Microarchitectural Attacks on Trusted Execution Environments" where Keegan Ryan
explains in great detail about how TEE attacks are performed. This is absolute gold for a person interested in defending against security breaches.

TLDR: Yes, it is indeed possible to compromise the PoET algorithm (SGXSpectre attack) as also by compromising a small fraction of the participant nodes. There are also some ways to mitigate if not resolve this issue (SGX SDK Patch, other approaches).