4 ms·
The BadRAM thing is interesting -- shouldn't this be easy to catch with a memory test? Chip lies that it's twice as big as it is, so just check if something yo
by dale_glass 2y ago
The BadRAM thing is interesting -- shouldn't this be easy to catch with a memory test?
Chip lies that it's twice as big as it is, so just check if something you write to 0x0001 shows up at 0x1001
Actually a bit surprising that modern boards don't do enough testing to catch this from the start -- checking that the address lines are working should take pretty much no time and would be a good check for whether a module is making good contact on all the pins.
- zrm 2y agoYou're trying to catch the specific implementation of the attack rather than the general attack. Suppose they don't lie about the size of the memory, instead they find a way to mask out one of the address bits so reads from higher addresses go to lower addresses or vice versa. Which they can change in hardware at runtime after you've done whatever checks you want and which doesn't necessarily have to be the most significant bit.
- dale_glass 2y agoOh, I'm sure, but this just seems like an oddly simple exploit that seems to rely on things that almost look like they shouldn't work. Like you'd think things like address lines being shorted together, or not being connected, or such things would be simple to test for in a millisecond or two, and be a logical part of a basic test of functionality that just checks that everything seems to be wired up right.