Modern RAM Used For Computers, Smartphones Still Vulnerable To Rowhammer Attacks (zdnet.com) 32
An anonymous reader writes: According to new research published this week, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack.
But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh" a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.
But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh" a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.
Re: (Score:2)
Factories being shut down due to COVID-19 I'd guess.
Re: (Score:2)
Doesn't matter (Score:3)
Side channel attacks either require intimate knowledge of the target machine and the active instance of software running on that machine (remember ASLR is a thing), or require the complete exfiltration of data, a process which would require multiple GB to be uploaded somewhere for specific analysis.
If you're the CIA or someone targeted by the CIA, be concerned, if not, well there's a wormable samba exploit out there to raise your heartrate.
What about SRAM? (Score:2)
Would S-RAM be affected by all those DDR-RAM exploits?
Asking for a friend.
Re: (Score:2)
Let me just pull out my old TRS-80 and see.
Re: (Score:3)
No,
These exploits use design limitations of DRAM and how they must be refreshed. The underlying issue is that it is possible to "hammer" a ram "row" fast enough that you out-stripe the refresh rate and start getting ram to return invalid bits.
Re: (Score:3)
Re: (Score:2)
The cache only has a finite amount of associativity which can be used up by writing to selected other locations between writes to the target locations.
Full Memory Encryption (Score:2)
If you enable full memory encryption, wouldn't that make it impossible for software to exploit specific bit patterns in DRAM? Doing that from the CPU shouldn't be too hard, and I understand AMD is in pretty good shape with it already, but I'm not clear on how they can handle device DMA with encryption since that does not go through the CPU.
Cores (Score:3)
Doing that from the CPU shouldn't be too hard, and I understand AMD is in pretty good shape with it already,
Yes, for the specific definition of CPU as in "the die package that I put in the CPU socket on my motherboard".
Inside that die, the memory encryption is implemented as part of the memory controller that talks to RAM chips
(i.e.: part of the circuitry that is considered North Bridge and used to be a phyically different chip on the motherboard some eons ago, before AMD started integrating them in the same package as the CPU).
but I'm not clear on how they can handle device DMA with encryption since that does not go through the CPU.
Correct, *iff* you define CPU as "the CPU core - i.e. the x86 core that actually runs
Re: (Score:2)
Re: (Score:2)
No, with full memory encryption, the key is generated and held in hardware with no ability to access it outside of the chip. And in this case, I'm not even talking about keeping things secret, I'm talking about making it impossible to control which bits are flipped in memory. So for Rowhammer to work with memory encryption, you would have to be able to reverse the encryption so that you could generate a desired ciphertext, and even with the encryption keys, that's not necessarily easy.
Re: (Score:2)
Re: (Score:2)
Are you even aware of the topic here and how Rowhammer works? How does that matter for defeating Rowhammer? How does that let you control exactly what bit patterns you write to physical DRAM?
Why "still"? (Score:4, Interesting)
I have run the rowhammer test on several computers for hours. Absolutely no results. I still suspect this only works on certain laptops that turn refresh rates down way too much to save power. The original publication was tested on a laptop only, AFAIK. Does anybody have different observations?
Re: (Score:2)
Re: (Score:3)
I don't know where you take that "industry average" from. The actually observable rate is much, much lower. In fact, I have been running data-intensive scientific computations for years on a cluster of 20 PCs where each bit-error would cause a failure due to compressed input data. The only bit-errors I ever found was from one weak bit in one of about 80 memory modules. After that was replaced, no more errors.
Re: (Score:2)
Re: Why "still"? (Score:2)
Re: (Score:2)
I worked with a gentleman who I believe discovered rowhammer in parallel with the research which led to the the original paper on the subject (i.e. we were aware of this issue before "rowhammer" was a term). His discovery was made while writing diagnostics for machines in the class of the largest servers and (non-cluster) supercomputers.
So, definitely not just a laptop issue.
Re: (Score:2)
So on a machine where ECC is used? Yes, that sounds credible...
I am going to believe this when I can recreate it on at least one of my machines, not before. And they are all non-ECC systems and several are laptops.
Re: (Score:2)
It generally happens on some memory modules and not others. Recent AMD systems are less vulnerable to this because Full Memory Encryption can defeat this using Address Scrambling. This ensures that the row you think y
Re: (Score:2)
I still suspect this only works on certain laptops that turn refresh rates down way too much to save power
If they do that, rowhammering (that works by performing very rapid read/write operations on a memory row) is even less likely to work!
Row Hammer Is Not A Thing (Score:3)
This isn't an exploit, you cannot initiate remote code on the PC using this method, you cannot predict what bits you're going to flip and your sure as hell can't accomplish anything except maybe crashing the PC.
Re: (Score:2)
You're correct that it's not really a major concern for now, of course. But exploits often begin life as just finding a way to crash the system, and only later become more powerful and more sophisticated. I'm not saying that will necessarily happen with Rowhammer-style attacks, but neither should the hardware industry just close their eyes and do nothing about these new potential exploits.
Re: (Score:2)
Re: (Score:2)
Long Passphrases are safe (Score:2)
I always used "beef stew" but I was told it was not Stroganoff.
Modern? (Score:2)
Modern Soldiers, used for Armies, still vulnerable to Nuclear Bombs.
You would think after more than 50 years this problem would have been solved.