3 ms·
I don't understand the threat model being attacked here. If you had physical DRAM access you could do all of this anyway right? And I would assume that an unpri
by dooglius 2mo ago
I don't understand the threat model being attacked here. If you had physical DRAM access you could do all of this anyway right? And I would assume that an unprivileged user would not have write access to the DRAM controller registers?
- quotemstr 2mo agoEven physical DRAM access would be thwarted by transparent total memory encryption, so this hack is still something else.
- Retr0id 2mo agoIt's not fully mitigated by encryption, you can still do a lot of damage without being able to observe plaintexts. For example, you could "rewind" a ciphertext block to an earlier value, and induce a UAF-like condition in the software it belongs to.
- rzhikharevich 2mo agoApple’s Secure Enclave has replay protection since Apple A11. Generally, I don’t see why a modern security platform wouldn’t have its own private SRAM to be used as a root of trust for encrypted blobs stored in shared DRAM.
- Retr0id 2mo agoRight, that is in addition to mere encryption.
- fulafel 2mo agoThis doesn't require physical DRAM access, it's all software. With ring-0 access, this lets you poke "even things walled off and invisible to ring-0 or the CPU itself" including things that the security processor tries hard to wall off.
- VorpalWay 2mo agoWhich arguably is a good thing. As a owner of the system I really should have complete control over it. But currently there is software I have no control over running at even higher privilege levels. The only modern silicon that gives me full control over what code is running is some (or most?) microcontrollers. And this isn't just a question of FOSS principle. Especially SMM is problematic by unpredictably taking CPU cycles away from your workload. This can mess up hard realtime workloads, such as found in CNC controllers. If you are running something like LinuxCNC this something you need to measure to figure out if a given computer is suitable for that job.
- eptcyka 2mo agoWhilst I like getting more control of my hardware, I really prefer if I can contain arbitrary software - sandbox it and compartmentalise it. If arbitrary processes can own your whole system, is anyone truly an owner?
- nullc 2mo agoYou're missing that modern CPUs substantially lock the users out of control of their own computer and include things like hidden additional network connected processors that run their own full on operating systems. ... and may well be used to surveil or remotely access your computers the the behest of powers unknown. But they still use system dram, so this approach allows looking into those parts of your own computer from which you're normally blocked. At least on some hardware...