4 ms·

I'm not a security expert by any means, but row hammer has always struck me as one of the most ingenious hacks ever. I mean if you can flip bits by sending elec

I'm not a security expert by any means, but row hammer has always struck me as one of the most ingenious hacks ever. I mean if you can flip bits by sending electric current repeatedly through a channel then what can't you do? Nothing is sacred. There is no God

godelmachine 7y ago
Flip bits by remotely executing a web page(which runs on JavaScript) on the target computer https://ieeexplore.ieee.org/abstract/document/7546493 https://ieeexplore.ieee.org/abstract/document/7546493
atq2119 7y ago
Rowhammer is special because it is active, analog, and remote. Sure, there have been analog side channel data leaks by observing the power consumption of smart cards, or even analog active attacks by messing with the power supplied to smart cards. But Rowhammer is active, can be done over the network, and relies on analog properties. It's really something special and, as a software person, quite scary.
pkaye 7y ago
Similar stuff can happen with NAND flash but the NAND flash controller can have algorithms to intervene.
- wtallis 7y ago
  NAND always has at least one or two layers of ECC protecting your data, so deliberately induced read disturb errors are a lot harder to turn into a practical exploit—and that's before adding any specific measures to predict and prevent read disturb errors.
  - pkaye 7y ago
    I used to work in SSD firmware development. Thing is the newer generations of NAND are quite fragile so the ECC protection is essential and it is a lot easier to trigger read disturb since you can issue millions of reads with ease. Of course various caches in the controller and system can mitigate the trivial access patterns. With read disturb detection algorithms the difficulty is you would need lots of fine grain access statistics to make it optimal.
mettamage 7y ago
This paper is fun [1]. TL;DR: rowhammer via JS/WebGL. [1] http://web.eecs.umich.edu/~genkin/teaching/fall2018/EECS598-12_files/glitch.pdf http://web.eecs.umich.edu/~genkin/teaching/fall2018/EECS598-...
fulafel 7y ago
Well, it's a hardware defect in some memory modules. Same types of tricks can be used to trigger nany kinds of hw bugs in various CPUs and other chips.

godelmachine 7y ago

Flip bits by remotely executing a web page(which runs on JavaScript) on the target computer https://ieeexplore.ieee.org/abstract/document/7546493 https://ieeexplore.ieee.org/abstract/document/7546493

atq2119 7y ago

Rowhammer is special because it is active, analog, and remote. Sure, there have been analog side channel data leaks by observing the power consumption of smart cards, or even analog active attacks by messing with the power supplied to smart cards. But Rowhammer is active, can be done over the network, and relies on analog properties. It's really something special and, as a software person, quite scary.

pkaye 7y ago

Similar stuff can happen with NAND flash but the NAND flash controller can have algorithms to intervene.

wtallis 7y ago
NAND always has at least one or two layers of ECC protecting your data, so deliberately induced read disturb errors are a lot harder to turn into a practical exploit—and that's before adding any specific measures to predict and prevent read disturb errors.
- pkaye 7y ago
  I used to work in SSD firmware development. Thing is the newer generations of NAND are quite fragile so the ECC protection is essential and it is a lot easier to trigger read disturb since you can issue millions of reads with ease. Of course various caches in the controller and system can mitigate the trivial access patterns. With read disturb detection algorithms the difficulty is you would need lots of fine grain access statistics to make it optimal.

mettamage 7y ago

This paper is fun [1]. TL;DR: rowhammer via JS/WebGL. [1] http://web.eecs.umich.edu/~genkin/teaching/fall2018/EECS598-12_files/glitch.pdf http://web.eecs.umich.edu/~genkin/teaching/fall2018/EECS598-...

fulafel 7y ago

Well, it's a hardware defect in some memory modules. Same types of tricks can be used to trigger nany kinds of hw bugs in various CPUs and other chips.