22 ms·
Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations
- rStar 5y agowho do we blame for this even being a problem? which engineers at what point in time thought this non error checking non state stable design was a good idea?
- speeder 5y agoWhy nobody make chips with more space between capacitors? Wouldn't this fix the issue?
- brokenmachine 5y agoCan anyone ELI5 how a bad guy would use rowhammer to escalate privileges? As I understand it, it's just flipping random bits, wouldn't that have a very low chance of doing anything useful?
- detaro 5y agoTwo things: a) you can test and map out the memory layout, so its not entirely random b) Often the system state can be manipulated in "safe" ways to increase the attack surface. E.g. you can cause the OS to fill lots of memory with a vulnerable data structure, like a page mapping, and at the same time reserve a lot of the memory (outside the area you want to target) yourself. This gives you a good chance something vulnerable will end up where you want it. Afaik the Project Zero blogpost or presentation about it had some detailed examples.
- brokenmachine 5y agoJust read the Project Zero https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html https://googleprojectzero.blogspot.com/2015/03/exploiting-dr... It's really amazing to me that people can understand how a computer works to the level to be able to make that a viable attack. Very impressive.
- nickcw 5y agoFrom the article: > We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. The fact that user space code can cause bit flips in your RAM is a hardware bug. I'd love to see this code in memory testers like memtest86 so I could send the RAM back if it ever caught a problem like this. I guess it shows just how close to the edge of not working our modern computing environment is.
- StillBored 5y agoPretty sure the passmark version does https://www.memtest86.com/compare.html https://www.memtest86.com/compare.html Except that the distro's are still shipping an older version due to license issues (or something like that AFAIK).
- temac 5y agoThe problem is right now DDR4 devices that work correctly in that regard, do not exist. Likely the best mitigation for any sensitive application, even so lightly, is DDR4 with ECC (even if it may not be enough, it is vastly better than nothing, and not just because of rowhammer) And I have no idea if the internal "ECC" of standard DDR5 helps or not. It is not intended for regular ECC level of reliability anyway. (And I have seen discussion about likely bitflips detected in crash dumps of M1 Pro devices) So, as much as I would like to return defective devices, I would probably be left with no computer, no smartphone, etc.
- jandrese 5y agoMaybe a paranoid app could try to allocate the memory adjacent to any sensitive bits as a buffer? That would be pretty difficult to do but might be possible if you are tremendously paranoid and have a good way to examine the hardware.
- pas 5y agoOr use different banks of DRAM for different security contexts, managed via NUMA?
- philipkglass 5y agoIs this possibly a route to jailbreaking for iOS, via the temporary provisioning profile for apps? It seems like you could run a Rowhammer memory corruption app on your personal device until getting escalated privileges. Newer OS releases may not patch the hole since this is a hardware flaw. But I admittedly have only the vaguest idea of what defenses need overcoming on a modern iOS device.
- londons_explore 5y agoRowhammer is still pretty hard to exploit because typically you can't reliably flip most bits, and you can normally only flip bits that are very close in physical memory address to those you control. Combine that with a lack of knowledge of physical memory addresses and inability to have much control over memory layouts, and it really gets tricky to gain privileges outside a lab environment in a reasonable short time. Remember that flipping bits at random will almost certainly kernel panic the machine before it gives you root access. I'm sure a determined attacker could do it though.
- jandrese 5y agoThis seems like a case where targeting an iPhone might make life easier. The hardware is quite uniform for a particular model.
- SV_BubbleTime 5y agoWhich gets you some architecture knowledge, but doesn’t promise or indicate that your userland ram space is adjacent to anything important. It’s a better start at playing the game though.
- guerrilla 5y ago> very close in physical memory address to those you control. Not quite. It doesn't require the ability to write to the neighboring cells, just read from them.
- chasil 5y ago
- belter 5y agoGreat work. Fascinating and depressing at the same time. Like watching your house on fire, but not being able to avoid getting mesmerized by the beautiful flames and tones as your designer furniture burns away :-) "...Are there any DIMMs that are safe? We did not find any DIMMs that are completely safe. According to our data, some DIMMs are more vulnerable to our new Rowhammer patterns than others. Which implications do these new results have for me? Triggering bit flips has become more easy on current DDR4 devices, which facilitates attacks. As DRAM devices in the wild cannot be updated, they will remain vulnerable for many years. How can I check whether my DRAM is vulnerable? The code of our Blacksmith Rowhammer fuzzer, which you can use to assess your DRAM device for bit flips, is available on GitHub. We also have an early FPGA version of Blacksmith, and we are working with Google to fully integrate it into an open-source FPGA Rowhammer-testing platform. Why hasn’t JEDEC fixed this issue yet? A very good question! By now we know, thanks to a better understanding, that solving Rowhammer is hard but not impossible. We believe that there is a lot of bureaucracy involved inside JEDEC that makes it very difficult. What if I have ECC-capable DIMMs? Previous work showed that due to the large number of bit flips in current DDR4 devices, ECC cannot provide complete protection against Rowhammer but makes exploitation harder. What if my system runs with a double refresh rate? Besides an increased performance overhead and power consumption, previous work (e.g., Mutlu et al. and Frigo et al.) showed that doubling the refresh rate is a weak solution not providing complete protection. Why did you anonymize the name of the memory vendors? We were forced to anonymize the DRAM vendors of our evaluation. If you are a researcher, please get in touch with us to receive more information. ..."
- buryat 5y agoit’s a ploy to sell more DRAM
- egberts1 5y agoIt’s a plot to resurge demands for DDR3s.
- Syonyk 5y agoOne of the more absurd plots... "It's broken! Buy more of the broken stuff!"
- throwaway2048 5y agoworks for intel
- cout 5y agoRedundant array of inexpensive RAM?
- javajosh 5y agoUm, how concerned should I be about this? Is it time to turn off javascript in the browser? And if it is, is this not the End Times for browser distributed software? I ask because sometimes you need to ask if it's really the end of the world or just Monday.
- Terr_ 5y ago> Is it time to turn off javascript in the browser? I've been browsing with Javascript off-by-default for years and recommend it regardless. Sure, perhaps a site I trusted and whitelisted will try to hack me, but I feel it's far less likely than some random typo-squatting site or advertising-broker logic.
- egberts1 5y agoJavaScript, despite compiler hardening, is still subjectable to SPECTRE-like actions. It’s in the compilers’ mitigation effort and CPU memory controllers both. Something about CPU firmware and its inability to fix some aspect of memory bank controllers.
- pas 5y agoIt depends on how concerned are you about the regular security issues. Which ideally depends on the things you are responsible for. If it's your family photos in iCloud? Nah. If it's the nuclear launch codes for the whole world? Then yeah, you should already be isolating separating compartmentalizing...
- myself248 5y ago> photos in iCloud? I mean, the last fappening was done by phishing, as I recall. Are you saying another one, done by rowhammer, wouldn't be a problem? I suspect most folks have stuff they'd rather not make public. Credit card numbers, at the very least. This affects us all.
- pas 5y agoWhile there are clearly bad (and some interesting) ethical aspects of the Fappening, it was not a big problem for society. Everyday many people experience the same violation of their privacy (revenge porn sites, accidentally sending nudes to the wrong address, etc), and life goes on. (And as far as I know nobody of the affected celebs have taken drastic measures, while unfortunately this cannot be said for non-celebs, as cyberbullying regularly gets people to attempt suicide with "success".) Similarly the day-to-day ransomwares probably cost more than securing browsers will.
- sroussey 5y agoI guess another plus for DDR5 which has some ECC built in to including in the non-ECC versions.
- temac 5y agoThe internal ECC in basic DDR5 is intended to provide a reliability just good enough to be at the level of DDR4 without ECC (or maybe slightly above, but probably not a lot?), and likely the error rate would just be crazy high without any DDR5 internal "ECC" at all -- even without a rowhammer pattern or cosmic rays, etc. I not sure it will help against rowhammer (and variants)?
- egberts1 5y agoOriginal author already said DDR5 ECC, once mapped, will too suffer SPECTRE.
- AaronFriel 5y agoSPECTRE is a CPU vulnerability in the speculative execution that modern processors perform to create a side channel to leak data through. Could you elaborate on what you mean by DDR5 "suffering" from SPECTRE? I believe that vulnerability is memory technology agnostic and theoretically would work if you could boot a CPU absent any memory at all, as the leaks occur through CPU caches.
- egberts1 5y agoCPU? More like memory controller and their capacitance banks.
- sroussey 5y agoAgreed, though did the spec for ddr5 finalize after row-hammer? Seems like an opportunity to adjust for attacks. They should do another set of tests on DDR5 and compare to DDR4.
- patryn20 5y agoAll these new hardware level physics exploits in software fascinate me. At the same time they make me wonder if the hardware will ever truly be able to be secure and perhaps we need to just move on to new methods and concepts in hardware design and maybe trade size for security. It also brings to mind that Simpsons scene: "Stop stop! He's already dead!"
- cout 5y agoIt also makes me think of the phonograph in Godel Escher Bach. One character made a record player and the other made a record that always caused the record player to break. The crux was that a record player cannot be built that can play all records; it is impossible.
- thinkingemote 5y agoI fully expect apples M1 chip to get a spectre type vulnerability at some point and then any improvements it had will disappear.
- mhh__ 5y agoM1 is vulnerable to Spectre (some variants at least) as far as I'm aware. Any speculation around memory accesses will yield this.
- zsmi 5y agoThat why the solution is to only allow speculation when it's "ok". M1 is believed to have a number of Spectre-esq security mechanisms built into it to determine just that. For example: https://patents.google.com/patent/US20200192673A1 https://patents.google.com/patent/US20200192673A1 Also, In dougallj's code [1] the zero of registers should be superfluous so it is assumed the function below is needed to make the experiments run stably by claiming ownership of the registers as part of a general anti-speculation security mechanism. static int add_prep(uint32_t *ibuf, int instr_type); The M1 explainer [2] has lot of interesting ideas like this contained inside it. [1] https://gist.github.com/dougallj/5bafb113492047c865c0c8cfbc930155 https://gist.github.com/dougallj/5bafb113492047c865c0c8cfbc9... [2] https://news.ycombinator.com/item?id=28549954 https://news.ycombinator.com/item?id=28549954
- buran77 5y agoI think the scary part is this one: > “DDR4 systems with ECC will likely be more exploitable, after reverse-engineering the ECC functions,” researchers Razavi and Jattke said.
- staticassertion 5y agoWhere are you reading this quote? I'm seeing essentially the opposite in the linked post. > ECC cannot provide complete protection against Rowhammer but makes exploitation harder. edit: I looked at some linked papers and I see similar quotes, though not that one. edit2: https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-more-susceptible-to-rowhammer-attacks-than-anyone-thought/ https://arstechnica.com/gadgets/2021/11/ddr4-memory-is-even-... > “DDR4 systems with ECC will likely be more exploitable, after reverse-engineering the ECC functions,” researchers Razavi and Jattke said. OK, so not more exploitable relative to not-ecc RAM, just relative to ecc ram pre-RE.
- cjsplat 5y agoI believe that is saying understanding ECC function details makes it easier to exploit EEC devices, not that it will be easier than exploiting non-ECC devices. The ECC code word is bigger so it is a larger target, but you have to flip multiple bits to cause pain. If you have 2 bit detect, you need to flip three bits to get something that corrects to a different value.
- 015a 5y agoEventually, it will be obvious that running shared workloads on a single piece of physical hardware has fundamentally unremediatable security implications. This slow recognition is deeply perpendicular with how the current landscape of x86 chips are both manufactured and priced, as well as how cloud providers have structured billions of dollars in DC investment; in other words, they'll down-play it. This will be a massive opportunity for ARM & SoC manufacturers in the coming years, as its far better positioned to offer, for example, a single rack appliance with 64 individual 2-core mini-computers at a price-point competitive with a 128 core x86 rack, as one computer. Computing moves in cycles: - 2000s: gigahertz race on each core - 2010s: increase core counts, multicore everything - 2020s: back to core-efficiency and increasing per-core performance. M1 is already leading this charge, but is obviously a mismatch for a DC environment. AMD and Intel need to adjust, or face extinction. Its not just about pushing ultra-high per-core performance (they're both good at this); its about pushing for more efficiency, so per-blade density in a DC can be pushed higher in the face of more, smaller individual computers. If they don't evolve, AWS will for them [1]. [1] https://aws.amazon.com/ec2/graviton/ https://aws.amazon.com/ec2/graviton/
- baq 5y agoAMD and Intel deliver CPUs tailor made for large cloud customers already; those SKUs are not available via normal channels.
- belter 5y agoCan you elaborate or provide a reference on how those CPUs are different?
- Syonyk 5y agoAnyone who would know the fine grained differences is almost certainly NDA'd up quite tightly. But it's likely things like different core counts, frequency performance curves, perhaps more or different memory/IO controller counts, perhaps instruction extensions of some particular interest (I'd wager BF16 was available in data center SKUs long before consumer SKUs), etc. It's nothing radical, but if you're going to buy an awful lot of them and want something slightly custom, Intel will definitely do that for you.
- egberts1 5y agoDoes not work on Intel Core Generation 1 (specifically Xeon Westmere EP hex-core) with DDR3-ECC. Perhaps I should start snapping them all up … because market demand.
- pomian 5y agoDid you discover anywhere how vulnerable DDR3 RAM is yet? Both ECC and regular? Since this is a hardware induced vulnerability, maybe it doesn't exist?
- egberts1 5y agoAnd this Intel Xeon E5660 overclocked to 4.1Ghz using DDR3-1600 makes it the cheapest 6-CPU per chipset evah … 7 years running (since 2015) and hopefully the safest. https://overclock-then-game.com/index.php/benchmarks/1-x5660-full-review https://overclock-then-game.com/index.php/benchmarks/1-x5660...
- yread 5y agoInteresting that there is a lot of variation between the modules - some get 1.1 million bit flips and some 14. Perhaps that was the ECC?
- fbanon 5y agoCan't wait for the first large-scale exploit of this stuff, which will finally force DRAM manufacturers to fix their faulty crap.
- passivate 5y agoWhy wish for exploits that harm regular users who have nothing to do with design decisions made by DRAM manufacturers?
- dredmorbius 5y agoUntil there are victims, threats tend to be ignored. This extends well beyond software. Next time you smell "gas", give a thought to the 300 souls of the New London School. https://en.wikipedia.org/wiki/New_London_School_explosion https://en.wikipedia.org/wiki/New_London_School_explosion Safety standards are written in blood.
- passivate 5y agoWe learn and improve when accidents happen, but there is no reason to wish harm on innocent people. >Until there are victims, threats tend to be ignored. If you can't convince someone to address a threat, you need to get better at convincing, rather than creating victims to prove a point.
- dredmorbius 5y agoI'd much prefer this were the case. History strongly suggests it is not. In large part because non-manifested risks, or not fully manifested risks tend to be dismissed or belittled, most especially when that denial is presently remunerative. Vaccination and non-pharmaceutical interventions against global pandemics, an economy based on massive surveillance by states / enterprises / other actors, global warming, CFCs and ozone depletion, use of lead (in fuels, paint, glazes, toys, and other materials), asbestos, tobacco, car and highway safety, racism and ethnic favouritism, industrial safety, mercury use, plastics, unoderised natural gas, mine safety, electrical codes, fire codes in buildings, ... In the infosec / cybersecurity world we've at least the advantage of being able to provide proofs of concept which move a given risk from the theoretical to the manifest. Even then, effective reduction or mitigation takes far too long. If there's a correction, I'd suggest that the onus be placed not on the advocates but the deniers. A marked penalty for advocating a position which turns out to be untrue with credible basis for knowing that it is untrue is one possibility that's occurred to me. How that would play out I'm unsure, but I'd be willing to explore the question. You're advocating ought. I'm describing is.
- zokier 5y agoI would imagine that SME/TME (AMD/Intel memory encryption) would mitigate Rowhammer-style attacks quite effectively because attackers would not be able to control the physical bit patterns anymore?
- guerrilla 5y agoNope. It only requires being able to read neighboring cells. It would make a privilege escalation attack harder but not impossible. DoS attacks would still be relatively easy.
- LogonType10 5y ago>DoS attacks would still be relatively easy. Local DoS? Can you elaborate on this?
- guerrilla 5y agoRowhammer is a memory corruption technique, so if you corrupt the right memory of a process in the right way then you can crash it; same for a kernel or hypervisor.
- 420official 5y agoThey are saying that privilege escalation is harder because it's really challenging to target specific bits to flip, whereas flipping random bits will eventually lead to a crash of some kind causing the service to fail which is effectively a DoS
- guerrilla 5y agoWow, it's so cool to see this post. I was just watching the digital design class from ETH Zürich and they went through Rowhammer (repeated three times) and I was wondering if the industry had solved anything and I suspected not based on their explanations. Now I wish I was actually sitting in class even more. I highly recommend that series by the way.[1] It's not just an architecture class because it's actually pretty up to date and highly focused on security. 1. https://www.youtube.com/watch?v=AJBmIaUneB0&list=PL5Q2soXY2Zi_FRrloMa2fUYWPGiZUBQo2&index=1 https://www.youtube.com/watch?v=AJBmIaUneB0&list=PL5Q2soXY2Z...
- ben_w 5y agoThis is probably a native question, but: could this sort of attack be prevented by having the physical values be trivially encrypted version of the logical values? I’m thinking something as simple as: $value XOR f(memory address, random number etched onto chip)
- jsmith45 5y agoThat could certainly make it more difficult to exploit, sure, but keep in mind that being able to force a specific value change is not a hard requirement for this to be a security bug. Even then, memory vendors tend to want to compete on frequency and access timings, which means doing any additional work not strictly required by the JEDEC standard will make their product appear worse than competing products, so I doubt they will want to do that. Plus a similar technique could actually be done by the CPU's memory controller to similar effect, and historically DRAM design has favored pushing things to the controller when possible.
- pxx 5y agoFlipping a bit flips the output of xor.
- matja 5y agoAMD EPYC processors already support AES encryption of memory (https://developer.amd.com/sev/ https://developer.amd.com/sev/) where VMs themselves cannot know the key. Interesting that I didn't see that mentioned in the paper as a possible mitigation.
- guerrilla 5y agoWhy do you believe this would help? Have you seen the attack from the BlackHat?[1] It doesn't require being able to read any plain text and it doesn't matter how the data is stored, only that it's near. You don't even have to have any access to the target memory or even know where it is, only the ability to cause something else to read it predictably. 1. https://www.blackhat.com/docs/us-15/materials/us-15-Seaborn-Exploiting-The-DRAM-Rowhammer-Bug-To-Gain-Kernel-Privileges-wp.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Seaborn-...
- HALtheWise 5y agoMaybe OS's or hypervisors should support a mode where different processes/security domains are forced into contiguous blocks of physical memory with buffer zones between. Especially for cloud computing, pre-allocating memory to different VMs should be reasonable. I could even see browsers taking advantage of it, given that they already force javascript threads into per-domain processes for Spectre/Meltdown protection.
- boibombeiro 5y agoBrainstorming some solutions. Maybe a randomized algorithm for ECC. Every so often changes how the ECC is computed? The region nearby where privileged information is stored could have a speed limit on multiple sequential writes? Add blocks that are more sucetible for those attacks to do early detection. A honeypot bit.
- bell-cot 5y agoFor higher-security situations, ECC memory with higher overhead (more spare bits, and an ECC algorithm which made good use of them). A DRAM-savvy OS might allocate memory so as to greatly reduce "critical data right next to untrusted data" situations. CPU's which noticed write-heavy program behavior (and alerted the OS) would be interesting...but foolproof implementation could prove difficult.
- acomjean 5y agoThis seems bad, but as a practical matter, what does this mean? If you have a process running on your machine can it use this to get root? Read Keys? It looks like they ran their process for 12 hours to do the flipping. And if your flipping your process's memory for that long, what are the chances you are next to sensitive memory for another process? It seems bad, but it seems like if your randomly flipping bits in memory the system will likely crash.
- ARandumGuy 5y agoThat's my question as well. I'm not a security expert, but this doesn't seem all that concerning for anything other then the highest security applications. It seems to me that executing this attack not only requires running code on the target machine (which admittedly isn't that big of a hurdle), but requires basically complete knowledge of memory allocation at the time of the attack, something that is fairly opaque and ever changing on most hardware. Is there something I'm missing here? What are the realistic attacks that this vulnerability allows?
- myself248 5y agoThere's no reason the code couldn't just blindly try every attack until it finds one that succeeds. If there's a malicious app that runs a lot (lookin' at you, random firefox tab that eats 99% of my CPU for minutes at a time and then goes idle again), it has all the time in the world.
- pfortuny 5y agoSee my reply above: in-memory data analysis…
- joebob42 5y agoIt might be hard to do a targeted attack. On the other hand, flipping random bits is likely to just start crashing stuff and / or producing incorrect results pretty reliably.
- guerrilla 5y agoSee my reply, sibling to yours.
- zw123456 5y agoDoes anyone know if SDRAM (SDR) is susceptible to this attack ? If you don't need speed but need security...
- anthk 5y agoHN itself shouldn't even need JS.
- mettamage 5y agoIt was an honor to have Kaveh as a teacher when he was still working for VUSec :)
- joebob42 5y agoTo my understanding it's still hard to exploit this to steal information / break access / etc just because you'd need to know where the right bits were. On the other hand, if all we want to do is break our adversary's process / crash it / make it perform arbitrary incorrect behavior, this seems substantially easier to accomplish even if we have no idea at all which bits we are flipping.
- r00fus 5y agoIs this purely an x86 concern or does it affect non-x86 usages of DRAM? ie, ARM cores, Apple Silicon, RISC-V, etc.
- zekica 5y agoIt affects all processors that use this type of DRAM. Apple uses LPDDR5x and from what I've read, they don't have ECC, so this attack should work fine on M1.
- pomian 5y agoIt is very reassuring that there is such an agency as the Computer Security Group ( this article). Run by and funded independently by a multi national science agency. Likely without oversight by any industrial organisation (read lobby group.) It would be nice to have similar scientific bodies for other livelihood and security threats, such as health, and logistics, most especially food, drugs and environmental issues( chemicals for example.) Will this agency become corrupted as those have been over time?
- contidrift 5y agoFor cosmetics: https://www.ewg.org/skindeep/ https://www.ewg.org/skindeep/
- adriag 5y agonice
- Animats 5y agoOK, for starters, ECC has to become standard. Then the rate of ECC errors has to be monitored. If something is trying a rowhammer attack, it's going to cause unwanted bit flips which the ECC will correct. Normally, the ECC error rate is very low. Under attack, it should go up. So an attack should be noticeable. You might get some false alarms, but that just means it's time to replace memory.
- arcticbull 5y agoLuckily all DDR5 DIMMs will have on-chip ECC. My understanding is it's not a complete mitigation but does make exploitation harder.
- snak 5y agoYes, the article mentions it: > What if I have ECC-capable DIMMs? > Previous work showed that due to the large number of bit flips in current DDR4 devices, ECC cannot provide complete protection against Rowhammer but makes exploitation harder.
- hinkley 5y agoIt sounds to me like ECC isn't being included in the DDR5 spec due to magnanimity so much as because it doesn't function without it. That ECC has become 'load-bearing'. Does that mean we need an extended ECC to deal with critical systems that require additional robustness?
- tambourine_man 5y agoThis kind of thing depresses me. We’re are building our infrastructure on quicksand.
- Karliss 5y agoWhile they were able to get bitflips with all the modules. Difference between 100000 and 15 bitflips during 12h seems significant to me. Whatever mitigation manfacturer B has seems to be work a lot better than others. That's potential reason for choosing to buy that instead of others. If that where to be improved further and decreased probability 10000 times more it might reach the point where its comparable to random bitflips from cosmic radiation.
- zanethomas 5y agoFunny thing about that. At Alpha Microsystems, about 1982, I was in charge of the diagnostic programming group. At that time failing memory boards were expensive and customers would not be happy with such components. I wrote a memory testing diagnostic that was based on knowing exactly how addresses were mapped to cell locations so I could try to provoke such failures. Chip manufacturers were aware of this problem which is why they scrambled the addresses. Potential vendors, Motorola et al, were required to provide mapping information before we would consider their chips. Now I'm curious to know what such mapping looks like with modern memory chips.
- classichasclass 5y agoNot related to article: would love to hear about your time at Alpha Microsystems. See https://ampm.floodgap.com/ https://ampm.floodgap.com/ (hosted on an Alpha Micro Eagle 300).
- zanethomas 5y agoHere's a bit of history ... I think the lead up helps to understand what I did first at AM. I'll send you an email with more info later. 1976-1985 My first job was at Basic Four Corporation. I got in as a test technician, assembling small refrigerator-sized mini-computers, giving them their first tests and swapping components until they passed. I soon learned how to use the machine-language assembler and started writing small programs to help me determine which components were failing without swapping and hoping. Within a few months I was testing more than 2x the number of machines the other techs were testing. Management noticed and soon the other techs were getting up to speed. At this point management pretty-much turned me loose. I moved up to diagnosing and repairing failed components (8"x11" pcbs). My understanding of programming and digital circuits allowed me to write small programs that could be used to "light up" specific circuits on the board making it easy to poke around with a scope to see where things went wrong. Again this was a huge productivity boost and the technique was propagated to other techs. A couple years later I went back for a while part-time as a consultant and wrote my first DSL for techs to use. Next I talked my way into the firmware development group and worked on firmware for tape, disk and other devices. This is the period of time when microprocessors were being incorporated into everything and my experience with the Micro-68 put me in a good position to participate. I also got to write microcode for a 2901-based cpu that was in development. And then, somehow, perhaps at a user's group, I learned about Alpha Microsystems. When I first visited Alpha Microsystems their idea of "burning in" pcbs consisted of putting them in a powered backplane, in a wooden box, with a lightbulb, where they sat for some period of time. Basic Four had serious testing which included putting entire computers into temperature-cycling ovens where they ran tests for 24 hours. That knocked out a pretty high percentage of boards. After I told them what they were missing Alpha Microsystems hired me to improve their process. For the next several years I participated in creating the flow of production and testing. A department evolved to handle the hardware side of things and I became head of a diagnostic programming department which grew to, variously, between 6 and 10 programmers. After that department was functioning and had someone who could step up I transferred into the operating systems group. I was one of only three people allowed to work on the operating system code, let alone even see it since it was held as a trade secret. During my last year at Alpha Microsystems a brilliant programmer I had hired introduced me to the then just-released Structure And Interpretation Of Computer Programming, a new textbook for students at MIT. That book's use of the language Scheme introduced me to first-class functions, closures, and many other concepts which found their way into popular programming languages decades later. The SICP had all the information one needed to create a Scheme interpreter. I wrote one using 68000 assembler so I could run the sample code.
- zsmi 5y agoThere was another paper last year that showed something similar, and it went into way more detail on what TRR actually is. TRRespass: Exploiting the Many Sides of Target Row Refresh https://arxiv.org/pdf/2004.01807.pdf https://arxiv.org/pdf/2004.01807.pdf Memory controller mitigation of RowHammer can work pretty well, if one actually has it turned on. Which is unfortunately rarely the case even in 2021.
- undoware 5y agoFormer startup CSO here. There is not enough coffee in the world to make this day not terrible for anyone whose job involves worrying about security.
- rkagerer 5y agoHow far back in time must one go to find main memory tech that would be immune to this? (eg. SRAM, magnetic core, vacuum tubes?)
- mdrzn 5y agoSomewhere they mention that even just DDR3 is immune from this, because the chip is not "crammed" enough to be susceptible to this attack.
- egberts1 5y agoBecause it is about the capacitance banks in the memory chips. It’s cheaper to buy a dual Xeon 5660 (six CPU times two chipset times two for SMT) and ply it with 244GB of DDR3-1600 to get an overclocked 4.4Ghz than it is to buy anything DDR4.
- josteink 5y agoDDR3 supposedly. It’s not packed as densely.
- Dylan16807 5y agoSo it's another Target Row Refresh bypass. Which is only possible because the DRAM has limited memory for recently-accessed rows. When is a company going to put out chips that have the access count stored inside the row? It's the most obvious way to do it and makes this entire class of attack impossible. Edit: Okay, reading the paper more apparently LPDDR5 has something similar to this. Why is LPDDR so divergent from normal DDR?
- Andys 5y agoIt would be so much easier if the RAM just got moved onto the CPU. As chips get more dense and NAND becomes cheaper, I could see rowhammer-susceptible DRAM just going away completely for many forms of computing.
- BenjiWiebe 5y agoWhy would DRAM on the CPU be better then DRAM off the CPU? (Ignoring the major drawback of not being able to replace/upgrade the RAM and CPU independently.)
- Andys 5y agoI could be wrong, but it seemed that this made it much easier to design away the problem.
- rasz 5y agodram is build out of small capacitors, fab process to make lots of capacitors is incompatible with one to make a lot of fast logic.
- guerrilla 5y agoWhy don't you work that SRAM pricing out and get back to us on that, keeping on mind people want exabytes of RAM now. If you mean just moving DRAM on chip, people are already doing that and it's irrelevant to Rowhammer. This is about capacitor physics, location doesn't play a role, only row layout and density. If they can solve it on chip then they can solve it off chip.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]