2 ms·
This is certainly a serious threat. However, it's my understanding that exploits depend on running code (including JavaScript) on the target system (or in a sa
by mirimir 8y ago
This is certainly a serious threat.
However, it's my understanding that exploits depend on running code (including JavaScript) on the target system (or in a sandbox or VM). Is that true?
- Eridrus 8y agoThere has been one paper recently that showed a rowhammer exploit over the network against a key-value server: https://www.usenix.org/conference/atc18/presentation/tatar https://www.usenix.org/conference/atc18/presentation/tatar I haven't read the paper, so I don't know how reliably they can do it in a real world setting where they are not the only people interacting with the server, but they demonstrate that it's possible.
- mirimir 8y agoImpressive. But isn't a key-value server perilously close to a database prompt? And this exploit depends on having authenticated access, right? Otherwise something like fail2ban would prevent hammering, I'd think.