'RAMBleed' Rowhammer Attack Can Now Steal Data, Not Just Alter It (zdnet.com) 45
A team of academics from the US, Austria, and Australia, has published new research today detailing yet another variation of the Rowhammer attack. From a report: The novelty in this new Rowhammer variety -- which the research team has named RAMBleed -- is that it can be used to steal information from a targeted device, as opposed to altering existing data or to elevate an attacker's privileges, like all previous Rowhammer attacks, have done in the past. [...] In a research paper [PDF] published today, academics unveiled RAMBleed, the first Rowhammer attack that can actively deduce and steal data from a RAM card. To do this, researchers had to come up and combine different techniques, which, when assembled, would permit a RAMBleed attack to take place.
These names are getting ridiculous. (Score:4, Funny)
RAMBleed ...
Alternately, you can use two small goats or a medium cow.
Re: (Score:2)
Re: (Score:2)
RAMBleed ...
Alternately, you can use two small goats or a medium cow...
I agree with this. Named vulnerabilities, or creatively named attacks, are tiresome.
...except for Rowhammer itself because it is just such a cool attack.
Re: (Score:2)
I agree with this. Named vulnerabilities, or creatively named attacks, are tiresome.
It's also the name of Thor's backup weapon.
Re: (Score:2)
I'd say its our hardware design that's ridiculous. Memory should be able to have any values written with any frequency, without disrupting adjacent cells. Plenty of memory does NOT have this problem, but somehow we think it's fine for PC and server memory to have this problem because we need high density, speed and low power consumption at all costs.
How about we line up the so-called "engineers" of this garbage against the wall and shoot them as a warning to others?
Re: (Score:2)
Pot, kettle.
Re: (Score:3)
Still not working here (Score:5, Interesting)
I have run the tester-tool for a while on my hardware (several computers), no results. And I noticed a while back that most (all?) papers that describe measurements have the measurements done on laptops, with potentially much slower refresh-schedules, as that saves a significant amount of energy. It also increases the susceptibility to Rowhammer strongly. Does anybody have any reference for Rowhammer actually working on regular PC hardware?
Re: (Score:2)
Have you got a reference? "Can work" is science jargon for "we have no clue but no evidence to the contrary either". It does not mean anything.
Scary. But practical? (Score:2, Interesting)
Having read the article I understand the basic principle being used, but other than maybe skimming some bits here and there would this ever yield useful data for an attacker?
In order "bleed" some bits your program can run in a VM (like AWS or Azure) or actually run in a client browser as a Javascript (!) program. But it has no control over what bits are adjacent and subject to exploit. What are the odds that you will actually be able to see the user's clear-text passwords? Not very high. So you get a
Re:Scary. But practical? (Score:4, Informative)
Having read the article I understand the basic principle being used, but other than maybe skimming some bits here and there would this ever yield useful data for an attacker?
Am I missing something?
Yes, you are missing the fact that storing private keys in RAM is a common practice for all virtualized appliances running in the cloud.
Re: (Score:1)
Exactly. That's how they're able USING JAVASCRIPT IN A USERLAND BROWSER to get the PRIVATE KEYS and ESCAPE THE VIRTUAL SANDBOX! That's why this is a big fucking deal. The entire cloud, boom.
Because you've got a hardware flaw that even 7 rings of abstraction aren't blocking off now, accessible without malware/root, over the internet, using nothing more than fucking javascript or other pseudo-innoculous inroad.
Javascript is enabled by default everywhere. Virtual machines are used everywhere. This is a s
Re: (Score:2)
LEARN TO READ ANYTIME OR DO NOT. (Score:1)
LEARN TO READ ANYTIME OR DO NOT.
Throughout the years, academics greatly expanded the methods and exploitation scenarios of the original Rowhammer research, taking a crazy experiment and showing how the technique could be used in the real world:
They showed how a Rowhammer attack could alter data stored on DDR3 and DDR4 memory cards alike
They showed how a Rowhammer attack could be carried out via JavaScript, via the web, and not necessarily by having a
Re: (Score:2)
Re: Scary. But practical? (Score:2)
Re: (Score:2)
But it has no control over what bits are adjacent and subject to exploit. What are the odds that you will actually be able to see the user's clear-text passwords? Not very high. So you get a byte or two at random among a 8G data field.
Cryptography, security and side channels are harder than you think. Sure you might see a cleartext password. Or you could leak 0.5 bits per day about some encryption key. Leave it running a while and you have enough information to crack some really important data.
Re: Microsoft makes piece of shit closed source OS (Score:1)
1. Source is available for Microsoft operating system and core components under an academic open source license.
2. RAMBleed and Rowhammer are hardware design flaws and impact Linux, macOS, and *BSD. Even in a virtual machine. Even if you have OpenBSD with encrypted swapfiles.
Re: (Score:2)
To be fair, for an attack to be successful, you need to place your allocated memory in a specific place.
They used a flaw in a Linux memory allocator to do that in this instance.
Researchers found a way to abuse the Linux buddy allocator to allocate a large block of consecutive physical addresses memory on which they could orchestrate their attack
i'm not scared (Score:2)
You can infer data in a group of cells if you can hammer cells in the same row, adjacent rows and sample in a series of cells physically next to the ones you want to read.
You need to be able to position all those blocks of ram in precise physical locations, after you've determined the physical cells of the data you want to read.
So says Steven "Tiberius" Gibson (Score:2)