4 ms·

RowHammer and the other speculative execution are really interesting attacks, but have they ever actually been used in the wild yet? I can't seem to find anythi

• quacksilver 3y ago
  The main concern is probably that the 'safety factor' between current publicly known state of the attack and it being dangerous is less than the community is comfortable with sensibly recommending is safe.
• kelsey9876543 3y ago
  the folks using them in the wild don't leave evidence they were threre
  • brookst 3y ago
    Same can be said of ghosts. I think it’s reasonable to question their existence.
    • TonyTrapp 3y ago
      The difference is that we haven't produced any proof-of-concept ghosts yet.
      • QuadmasterXLII 3y ago
        “Sure, MIT can extract the layout of a maze from a rat’s soul up to 30 minutes after death using a Ouija board, but the headline doesn’t mention that it also takes a 4 T magnet, a 3 TW pulsed laser, and a convergence of at least five Leylines. I think the philosophical implications are overstated.“
        • ddingus 3y ago
          Yeah, I am laughing over here. Perfect.
    • superq 3y ago
      Bit flipping is based on falsifiable science. There's no dispute about whether it exists, just whether it's feasible to exploit it.
    • omginternets 3y ago
      I’ve never seen a proof-of-concept ghost.
      • coldtea 3y ago
        Millions however have seen an actual one, or so they say.
        • 6th 3y ago
          Billions say <insert their deity> exists too. So. What. That's not proof.
          • coldtea 3y ago
            Isn't it? Historically it has qualified as proof to whole societies.
  • tedunangst 3y ago
    But why not? Intruders attempting escalation leave all sorts of detritus.
  • toast0 3y ago
    Rowhammer and similar bugs where the attacker can cause bitflips but not have tight selection of which bits are flipped are going to leave evidence. On systems with ECC, you're highly likely to get elevated correctable and uncorrectable error counts. Most systems will halt or reboot on uncorrectable errors, and usually that leaves a lot of logs. Correctable errors should also leave a trail, too. With RowHammer, sometimes you get enough bitflips that ECC can't detect or correct the error, but it's a distribution and many of the bitflips will be detected or corrected. I don't quite understand this one, but I imagine it's going to be similar --- you usually need to do a lot of attempts to get the bits you wanted flipped, and some of those failed attempts will trigger ECC; if the attacker gets really lucky, there won't be a trace, but if they're attacking multiple systems, they're unlikely to get the flips they want on the first try on all the systems. On systems without ECC, you're likely to get increased crashiness on systems under attack. It'll be much harder to track down of course, but it won't be without evidence. Speculative execution attacks to read memory can leave evidence too, but it depends on what level of statistics are tracked. I would suspect few systems collect the detailed statistics you'd need.
• hannob 3y ago
  > RowHammer and the other speculative execution are really interesting attacks, but have they ever actually been used in the wild yet? It's a question I've been asking myself for many highly publicized vulns. I once made this table: https://github.com/hannob/vulns https://github.com/hannob/vulns
  • taway1237 3y ago
    Thanks for making this table, it's really interesting. But I'm not sure I fully understand the point it makes (if there is one). Most of the vulnerabilities absolutely had potential of abuse, but were not used in the wild because the vulnerability disclosure process actually worked as intended and they were promptly patched.
    • fulafel 3y ago
      > not used in the wild because the vulnerability disclosure process actually worked This mental model kind of works for thinking about widespread exploitation but of course the vulnerabilities don't materialize when they are publicized, and most exploitations aren't publicly documented even if detected.
• denton-scratch 3y ago
  > and the other speculative execution I don't think RowHammer is a speculative execution attack, is it? I thought Spectre and Meltdown were the best-known examples of SE attacks.
  • vlovich123 3y ago
    That’s correct. RowHammer is a HW attack on the DRAM controller and how DRAM refresh works at a low level. Spectre/meltdown are a HW attack on the speculative execution unit within the CPU. Similar in terms of being HW attacks to exfil data across process boundaries. Different in that the former is more of a a physical attack while the latter is more of a logical side channel attack.
• fulafel 3y ago
  Cloud providers would be the most lucrative targets, and they keep their incidents quiet.
• layer8 3y ago
  The thing is, you don’t want to wait until someone finally figures out a practical attack before implementing the mitigations. You never know when a combination of weaknesses suddenly opens up a serious vulnerability.