3 ms·

Is there any evidence it's not just a matter of time before there is?

by atatatat 5y ago

karmicthreat 5y ago
Rowhammer has been known of for over 5 years.
- ygjb 5y ago
  You don't need to have a practical attack for something to be a credible threat that needs to be addressed in a multi-tenant system (like say, cloud providers).
mhh__ 5y ago
Rowhammer, Spectre, etc. are all very high-information attacks which strike me as not worth the effort for run of the mill adversaries. Three-letter agencies, however, I suspect might have played around with them - if a cloud vendor is secure, and they need a way to un-secure it, they have the resources to get microarchitectural researchers sworn to secrecy to make these attacks work.
- staticassertion 5y ago
  TBH I think right now it's more of an incentive thing. Consider that: a) Attackers would have to develop the POC. This will require a somewhat different skillset than typical exploitation, so there's effort involved. b) Rowhammer is best for privilege escalation. For desktop users (where the most money is) privesc is already pretty trivial - no need for fancy exploits, you can pretty much just ask for root or use a much more straightforward exploit. c) Exploit devs don't typically like a lot of attention. You don't want to be the first person selling rowhammer exploits unless you can charge out the ass for it, because you're gonna get way more attention for it. These incentives aren't super technical, they're mostly market driven, and it's why we don't see fancier attacks in practice, even if they're practical. As one attacker I know was saying to me, they wish they had an excuse to do the fancy thing, but it's never worth the investment when you can own boxes way more easily. Another hacker said "I don't want a Krebs article on me because I did something clever". NSA's incentives are not super difference, except they're not as directly financial. They also have crazy resources to fuck around with this stuff, so it would make sense that they'd demo it in a lab. Would they actually deploy it? Eh, doubtful. Against another advanced defender rowhammer should be pretty detectable by monitoring ECC metrics, and again, why would you do something fancy when you can just buy 0days - the USG purchases hundreds a year from private companies and develops more themselves.

Is there any evidence it's not just a matter of time before there is?

karmicthreat 5y ago

Rowhammer has been known of for over 5 years.

ygjb 5y ago
You don't need to have a practical attack for something to be a credible threat that needs to be addressed in a multi-tenant system (like say, cloud providers).

mhh__ 5y ago

Rowhammer, Spectre, etc. are all very high-information attacks which strike me as not worth the effort for run of the mill adversaries. Three-letter agencies, however, I suspect might have played around with them - if a cloud vendor is secure, and they need a way to un-secure it, they have the resources to get microarchitectural researchers sworn to secrecy to make these attacks work.

staticassertion 5y ago
TBH I think right now it's more of an incentive thing. Consider that: a) Attackers would have to develop the POC. This will require a somewhat different skillset than typical exploitation, so there's effort involved. b) Rowhammer is best for privilege escalation. For desktop users (where the most money is) privesc is already pretty trivial - no need for fancy exploits, you can pretty much just ask for root or use a much more straightforward exploit. c) Exploit devs don't typically like a lot of attention. You don't want to be the first person selling rowhammer exploits unless you can charge out the ass for it, because you're gonna get way more attention for it. These incentives aren't super technical, they're mostly market driven, and it's why we don't see fancier attacks in practice, even if they're practical. As one attacker I know was saying to me, they wish they had an excuse to do the fancy thing, but it's never worth the investment when you can own boxes way more easily. Another hacker said "I don't want a Krebs article on me because I did something clever". NSA's incentives are not super difference, except they're not as directly financial. They also have crazy resources to fuck around with this stuff, so it would make sense that they'd demo it in a lab. Would they actually deploy it? Eh, doubtful. Against another advanced defender rowhammer should be pretty detectable by monitoring ECC metrics, and again, why would you do something fancy when you can just buy 0days - the USG purchases hundreds a year from private companies and develops more themselves.