4 ms·

Apple is using the same commodity DRAM chips as everyone else. I doubt they are immune.

bilbo0s 9y ago
No need to "doubt". Just try Rowhammer via GLitch on a test iOS device. It will either work, or it will not. We need more people trying this out, informing vendors, and reporting their results in a REPLICABLE fashion.
- gruez 9y ago
  >Just try Rowhammer via GLitch on a test iOS device from TFA: >the PoC currently works only on a Nexus 5 phone
  - bigiain 9y ago
    This makes me _more_ certain iOS will end up being _more_ vulnerable to this type of attack. It's almost certainly quite hardware specific, and if you were weaponising this there's way more homogeneous hardware on iOS than Android. Get this working on iPhone 7/8/X and you've probably got 75% of the "high value" iOS device fleet covered.
- slededit 9y ago
  They are probably immune to this specific implementation simply because the relevant bits are in different locations - but not to the attack in general.
xenadu02 9y ago
Row hammer mitigations exist. Do you have some proof one way or the other?
- slededit 9y ago
  Although not evidence either way - were apple to include mitigation for row hammer its most likely they would advertise it as they do their other security infrastructure. Its about on-par with the encryption processor in the imac pro in terms of technicality and that is public information.
  - aflam 9y ago
    They did increase their DRAM refresh rate and mentioned it in release notes. There is not much more you can do easily - and it comes at a real cost in power usage. https://support.apple.com/en-us/HT204934 https://support.apple.com/en-us/HT204934
    - slededit 9y ago
      You can actually refresh specific rows adjacent to frequently accessed ones by issuing ACT->Precharge command combos. Timed right it only comes into play during attacks (whether intentional or by coincidence) and therefore has little additional power usage. Also that release note was for the Mac not the iPhone. They are less likely to apply that mitigation to the iPhone precisely because it would result in increased power consumption. They could however integrate the more advanced fix in the memory controller since they control the SoC. I would expect them to brag about it if they had.
      - aflam 9y ago
        Exactly, that is a beautiful mitigation - as long as you can upgrade the memory controller. I really hope vendors are doing this on all new chips!

No need to "doubt". Just try Rowhammer via GLitch on a test iOS device. It will either work, or it will not. We need more people trying this out, informing vendors, and reporting their results in a REPLICABLE fashion.

gruez 9y ago
>Just try Rowhammer via GLitch on a test iOS device from TFA: >the PoC currently works only on a Nexus 5 phone
- bigiain 9y ago
  This makes me _more_ certain iOS will end up being _more_ vulnerable to this type of attack. It's almost certainly quite hardware specific, and if you were weaponising this there's way more homogeneous hardware on iOS than Android. Get this working on iPhone 7/8/X and you've probably got 75% of the "high value" iOS device fleet covered.
slededit 9y ago
They are probably immune to this specific implementation simply because the relevant bits are in different locations - but not to the attack in general.

xenadu02 9y ago

Row hammer mitigations exist. Do you have some proof one way or the other?

slededit 9y ago
Although not evidence either way - were apple to include mitigation for row hammer its most likely they would advertise it as they do their other security infrastructure. Its about on-par with the encryption processor in the imac pro in terms of technicality and that is public information.
- aflam 9y ago
  They did increase their DRAM refresh rate and mentioned it in release notes. There is not much more you can do easily - and it comes at a real cost in power usage. https://support.apple.com/en-us/HT204934 https://support.apple.com/en-us/HT204934
  - slededit 9y ago
    You can actually refresh specific rows adjacent to frequently accessed ones by issuing ACT->Precharge command combos. Timed right it only comes into play during attacks (whether intentional or by coincidence) and therefore has little additional power usage. Also that release note was for the Mac not the iPhone. They are less likely to apply that mitigation to the iPhone precisely because it would result in increased power consumption. They could however integrate the more advanced fix in the memory controller since they control the SoC. I would expect them to brag about it if they had.
    - aflam 9y ago
      Exactly, that is a beautiful mitigation - as long as you can upgrade the memory controller. I really hope vendors are doing this on all new chips!