3 ms·

the folks using them in the wild don't leave evidence they were threre

by kelsey9876543 3y ago

brookst 3y ago
Same can be said of ghosts. I think it’s reasonable to question their existence.
- TonyTrapp 3y ago
  The difference is that we haven't produced any proof-of-concept ghosts yet.
  - QuadmasterXLII 3y ago
    “Sure, MIT can extract the layout of a maze from a rat’s soul up to 30 minutes after death using a Ouija board, but the headline doesn’t mention that it also takes a 4 T magnet, a 3 TW pulsed laser, and a convergence of at least five Leylines. I think the philosophical implications are overstated.“
    - ddingus 3y ago
      Yeah, I am laughing over here. Perfect.
- superq 3y ago
  Bit flipping is based on falsifiable science. There's no dispute about whether it exists, just whether it's feasible to exploit it.
- omginternets 3y ago
  I’ve never seen a proof-of-concept ghost.
  - coldtea 3y ago
    Millions however have seen an actual one, or so they say.
    - 6th 3y ago
      Billions say <insert their deity> exists too. So. What. That's not proof.
      - coldtea 3y ago
        Isn't it? Historically it has qualified as proof to whole societies.
tedunangst 3y ago
But why not? Intruders attempting escalation leave all sorts of detritus.
toast0 3y ago
Rowhammer and similar bugs where the attacker can cause bitflips but not have tight selection of which bits are flipped are going to leave evidence. On systems with ECC, you're highly likely to get elevated correctable and uncorrectable error counts. Most systems will halt or reboot on uncorrectable errors, and usually that leaves a lot of logs. Correctable errors should also leave a trail, too. With RowHammer, sometimes you get enough bitflips that ECC can't detect or correct the error, but it's a distribution and many of the bitflips will be detected or corrected. I don't quite understand this one, but I imagine it's going to be similar --- you usually need to do a lot of attempts to get the bits you wanted flipped, and some of those failed attempts will trigger ECC; if the attacker gets really lucky, there won't be a trace, but if they're attacking multiple systems, they're unlikely to get the flips they want on the first try on all the systems. On systems without ECC, you're likely to get increased crashiness on systems under attack. It'll be much harder to track down of course, but it won't be without evidence. Speculative execution attacks to read memory can leave evidence too, but it depends on what level of statistics are tracked. I would suspect few systems collect the detailed statistics you'd need.

the folks using them in the wild don't leave evidence they were threre

brookst 3y ago

Same can be said of ghosts. I think it’s reasonable to question their existence.

TonyTrapp 3y ago
The difference is that we haven't produced any proof-of-concept ghosts yet.
- QuadmasterXLII 3y ago
  “Sure, MIT can extract the layout of a maze from a rat’s soul up to 30 minutes after death using a Ouija board, but the headline doesn’t mention that it also takes a 4 T magnet, a 3 TW pulsed laser, and a convergence of at least five Leylines. I think the philosophical implications are overstated.“
  - ddingus 3y ago
    Yeah, I am laughing over here. Perfect.
superq 3y ago
Bit flipping is based on falsifiable science. There's no dispute about whether it exists, just whether it's feasible to exploit it.
omginternets 3y ago
I’ve never seen a proof-of-concept ghost.
- coldtea 3y ago
  Millions however have seen an actual one, or so they say.
  - 6th 3y ago
    Billions say <insert their deity> exists too. So. What. That's not proof.
    - coldtea 3y ago
      Isn't it? Historically it has qualified as proof to whole societies.

tedunangst 3y ago

But why not? Intruders attempting escalation leave all sorts of detritus.

toast0 3y ago

Rowhammer and similar bugs where the attacker can cause bitflips but not have tight selection of which bits are flipped are going to leave evidence. On systems with ECC, you're highly likely to get elevated correctable and uncorrectable error counts. Most systems will halt or reboot on uncorrectable errors, and usually that leaves a lot of logs. Correctable errors should also leave a trail, too. With RowHammer, sometimes you get enough bitflips that ECC can't detect or correct the error, but it's a distribution and many of the bitflips will be detected or corrected. I don't quite understand this one, but I imagine it's going to be similar --- you usually need to do a lot of attempts to get the bits you wanted flipped, and some of those failed attempts will trigger ECC; if the attacker gets really lucky, there won't be a trace, but if they're attacking multiple systems, they're unlikely to get the flips they want on the first try on all the systems. On systems without ECC, you're likely to get increased crashiness on systems under attack. It'll be much harder to track down of course, but it won't be without evidence. Speculative execution attacks to read memory can leave evidence too, but it depends on what level of statistics are tracked. I would suspect few systems collect the detailed statistics you'd need.