8 ms·
Drive-by Rowhammer attack uses GPU to compromise an Android phone
- ouid 8y agorowhammer is the best name yet for a security vulnerability.
- ams6110 8y agoPretty much ready to ditch my smartphone. iPhones are too expensive and affordable Android phones are a security mess since they never get updated.
- philfrasty 8y agoBuy a used iPhone? I am on a 6 and it works just fine. Goes for around 150$ to 200$ non negotiated.
- Someone1234 8y agoProblem is the battery and storage degradation is very real. While a simple factory reset solves some of the storage fragmentation, you'll never get the original owner's same experience with the device (unless you won the used device lottery and received a barely used handset). But something like an iPhone 6 definitely is a competitor against a brand new $200 Android device (and may receive security updates for longer).
- fooker 8y agoOut of curiosity, when have you last used a 200$ Android phone? The options available nowadays are pretty good with updates (from Android One initiative) and hardware similar to (in a few cases, significantly better than) last gen flagships.
- lostmsu 8y agoCare to name a few?
- kbenson 8y agoI just bought a few for testing at work. There's the HTC EVO 10 for $185[1], the Huawei Honor 6X for $200[2], and the Motoroloa Moto E4 Plus for $130(!)[3]. I also got a Samsung S6 to test, but at $250 for a much older phone, I wouldn't recommend it (but it is a fine phone, it's what I've been using personally for a few years). I just set them up today, but I have to say, the $130 price point of the Moto E4 is pretty enticing given it seems responsive and has a fairly large screen (and if you are fine with Verizon, you can get it for $70 no contract[4]). The H6 seems like the one aimed the most to be a flagship phone. Fairly polished, and with a rear fingerprint sensor (all or almost all the rest have a fingerprint sensor, it's just on the front). Edit: Whoops, the Verizon link and price is for the Moto E4, while what I purchased was a Moto E4 Plus, which Verizon has for $110[5]). 1: https://www.amazon.com/HTC-32GB-UNLOCKED-Version-GunMetal/dp/B079K346ZL https://www.amazon.com/HTC-32GB-UNLOCKED-Version-GunMetal/dp... 2: https://www.amazon.com/Honor-6X-Unlocked-Smartphone-Silver/dp/B01N6IW6UN/ https://www.amazon.com/Honor-6X-Unlocked-Smartphone-Silver/d... 3: https://www.amazon.com/XT1771-Finger-International-Version-Desbloqueado/dp/B072QN1FJV https://www.amazon.com/XT1771-Finger-International-Version-D... 4: https://www.verizonwireless.com/prepaid/smartphones/moto-e4-prepaid/ https://www.verizonwireless.com/prepaid/smartphones/moto-e4-... 5: https://www.verizonwireless.com/prepaid/smartphones/moto-e4-plus-prepaid/ https://www.verizonwireless.com/prepaid/smartphones/moto-e4-...
- merb 8y agothe battery could be replaced for 50 usd
- hungerstrike 8y agoI buy all of my Apple equipment used or refurbished. I only need it to build and test iOS apps, but it’s perfectly usable if you like Apple stuff.
- burnte 8y agoGet a phone from someone who updates, like the Google Pixel.
- ocdtrekkie 8y agoGoogle may be marginally better at updating their own devices, but they regularly suggest Play Protect as how to stay safe from malware, a piece of software that ranks dead last (literally zero stars) for detection rate on AV-TEST[1]. It's the sort of "here's a green check mark, just trust us" security approach that has carried McAfee for decades. I was hoping we'd hear some changes with the new security lead at Android, but so far its been more of the same. [1] https://www.av-test.org/en/antivirus/mobile-devices/ https://www.av-test.org/en/antivirus/mobile-devices/
- veeti 8y agoHow to stay safe from Android malware: buy a phone with regular security updates. Don't install random APK's from Russian boards. Simple. Android AV is useless bloat. It runs in its own sandbox just like every other app. Play Protect is the only one with privileges to actually do something.
- ocdtrekkie 8y agoIf Play Protect is the only one that can do something, we are in deep trouble, given its detection rate...
- gcb0 8y agoI'm a sucker who bought from nexus one to moto x dev edition (during google ownership of motorola), and all in between... all promised continuous android updates. all had a SINGLE major version update, just like any other flagship phone. don't buy google marketing. btw, im running recent versions via community roms on all of them, even the nexus one! so not hardware limitation, but the same greed and planed obsolescence at play on other companies makes google abandon phones just the same. stop spreading lies for them, please.
- slededit 8y agoApple is using the same commodity DRAM chips as everyone else. I doubt they are immune.
- bilbo0s 8y agoNo need to "doubt". Just try Rowhammer via GLitch on a test iOS device. It will either work, or it will not. We need more people trying this out, informing vendors, and reporting their results in a REPLICABLE fashion.
- gruez 8y ago>Just try Rowhammer via GLitch on a test iOS device from TFA: >the PoC currently works only on a Nexus 5 phone
- bigiain 8y agoThis makes me _more_ certain iOS will end up being _more_ vulnerable to this type of attack. It's almost certainly quite hardware specific, and if you were weaponising this there's way more homogeneous hardware on iOS than Android. Get this working on iPhone 7/8/X and you've probably got 75% of the "high value" iOS device fleet covered.
- slededit 8y agoThey are probably immune to this specific implementation simply because the relevant bits are in different locations - but not to the attack in general.
- xenadu02 8y agoRow hammer mitigations exist. Do you have some proof one way or the other?
- slededit 8y agoAlthough not evidence either way - were apple to include mitigation for row hammer its most likely they would advertise it as they do their other security infrastructure. Its about on-par with the encryption processor in the imac pro in terms of technicality and that is public information.
- voidlogic 8y ago> Android phones are a security mess since they never get updated. Use Google Fi? Latest, regularly updated Android on nice hardware... cheap rates..
- plussed_reader 8y ago"Android on nice hardware..." Tell that to the 5X users...
- StudentStuff 8y agoDon't forget the 6P users either!
- deleted 8y ago[deleted]
- josteink 8y agoThe phone that got me to give up on Nexus. Worst phone I ever had.
- Zekio 8y agoYou should look into the latest Nokia android phones, they are receiving updates rapidly, and they've promised to update them for quite a while EDIT: best part they are really cheap but great build quality
- rightos 8y agoAny Android One device is probably worth a look. Maybe used iPhones too - though given Apple's slowdown with old batteries and attitude towards right to repair I'd be quite hesitant to seriously suggest that these days.
- baybal2 8y agoI will be joining a long line of people with "I told you..." said in address of dotcom browser devs shoveling OpenGL with effectively raw GPU memory access into browsers.
- fulafel 8y agoIt's a hardware flaw in this case though, and apps are another vector. Android even has drive by ("instant") apps these days. (And WebGL is far from raw gpu access)
- djrogers 8y agoBut that’s exactly the point - the more hardware you expose to web browsers, the bigger the attack surface for web-based attacks.
- fulafel 8y agoYeah, it's a valid position to want to limit the web platform's capabilities so that implementations are simpler and have fewer places where bugs can happen. The other position is that walled garden platforms (like Apple/Google app stores) could then make the web irrelevant as an app platform. It would be nice if there were 2 "profiles" that web pages could conform to, browsers would only enable "simple content" profile by default...
- jdashg 8y agoThat is a line that historically had no one in it. There was much wringing of hands over WebGL, but "access to raw GPU memory" never came up as a concern, and is not even the issue here! This exploit specifically only functions on UMA devices, where GPUs use unified system memory, and thus have no more or less access to it than ArrayBuffers. It turns out CPU memory accesses are too slow (really simplifying here) to rowhammer.
- textmode 8y agoQuestion: How would this type of attack be implemented without using Javascript?
- _o_ 8y agoWell webgl, canvas and audio functionality of javacript are anyway nice to be disabled due to browser fingerprinting, now there is just another good case to disable webgl. But this is getting crazy, I think that todays CPUs, need a serious step back and rethinking.
- someperson 8y agoSo fundamentally, due to mitigatable-but-impossible-to-fully-patch hardware exploits like Rowhammer and Spectre, client-based sandboxing cannot be relied upon. Seems that a good approach for the average HN user is to disable Javascript for all sites, but whitelisting trusted sources (of course with HTTP MITM over compromised routers, never execute any code with questionable integrity, so anything delivered over a non-TLS connection) Goes without saying one should only use the minimal possible amount of native applications too: ideally none except perhaps the smartphone OS-vendor's trusted applications (your OS-vendor can already arbitrarily execute code and read memory). Using the OS-vendor's web browser with Javascript disabled shouldn't be too much of a security risk.
- nradov 8y agoEven seemingly trusted web sites are often pulling in JavaScript libraries from third party CDNs, analytics services, and advertising networks. It's almost impossible to be certain that none of those are compromised.
- someperson 8y agoTrue, but at least the attack surface area will have been reduced by a large amount which is worth something. Disabling Javascript served over HTTP is such a good security improvement that I'm surprised no browser vendor has implemented yet, in the age of Let's Encrypt. It'll break a lot of websites, but better than compromised routers and ISPs serving JS malware.
- pietroglyph 8y agoDecentraleyes[0] is a great plugin that intercepts many popular 3rd party CDN requests and replaces them with local copies. It's not a silver bullet, but it reduces CDN-based tracking and the chance of the attack described in the parent comment. Subresource integrity[1] is a technology that's been available for a while that also mitigates this attack, if used properly by website owners. [0]: https://decentraleyes.org/ https://decentraleyes.org/ and https://github.com/Synzvato/decentraleyes https://github.com/Synzvato/decentraleyes [1]: https://www.w3.org/TR/SRI/ https://www.w3.org/TR/SRI/
- sengork 8y agoIt is interesting to note that DDR and DDR2 are more immune to this kind of attack. Older computers with decently patches OS/browser would be safer to use for those who want to avoid Row hammer. https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer