Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New cloud attack takes full control of virtual machines with little effort

arstechnica.com

Post reply on HN
Print view View original

11–20 of 105 posts

Re: New cloud attack takes full control of virtual machines with little effort

#11

Post by DigitalJack »

andrewstuart2 wrote: post #9

It seems the HN title and original title are both pretty wrong, at least according to the article content. The attack vector is really the ability to, if you have a known public key and a server using it, perform a pre-calculated bit flip such that the new public key is much easier to factor, and thus obtain a corresponding private key. So you're not obtaining original private keys, you're altering original public ke…

It's the sort of thing for which the NSA would spend their resources to develop an exploit tool.

Re: New cloud attack takes full control of virtual machines with little effort

#12

Post by TheWiseOne3 »

SBArbeit wrote: post #8
wmf wrote: post #7

Earlier quoted context omitted.

No, because AFAIK EC2 does not dedupe RAM.

What about Hyper-V / Microsoft Azure? Anyone know if they de-dup memory like this?

Like most security vulnerabilities these days, this attack works only on Linux.

Re: New cloud attack takes full control of virtual machines with little effort

#13

Post by caf »

quickben wrote: post #10
caf wrote: post #5

I wonder if it would be worth checksumming public keys and re-checking the checksum each time it's used?

Something like Perspectives for Firefox?

No, much simpler - store a checksum alongside public keys in places like .ssh/authorized_keys, and have the software like sshd recompute the checksum of the in-memory key each time it uses it for authentication.

The attack relies on glitching the in-memory key.

Re: New cloud attack takes full control of virtual machines with little effort

#14

Post by userbinator »

The rowhammer "attack" is successful only because the hardware is just plain broken, and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and it should be possible, since apparently previous generations of RAM don't have this problem at all. In the early 90s Intel recalled and replaced, free of charge, CPUs which didn't divide correctly. Perhaps the memory manufacturers today should do the same for rowhammer-affected modules and chips.

Memory errors are particularly disturbing because they are often highly dependent on data and access patterns, and can be extremely difficult to pinpoint without special testing tools. I've personally experienced a situation where a system which otherwise appears to work perfectly well would always corrupt one specific bit of a file when extracting one particular archive.

As a testing tool, MemTest86+ has always worked well for me, and the newer versions can detect rowhammer, although there is this interesting discussion about whether it is actually a problem (to which I say a resounding YES!!!) or if there's some sort of cover-up by the memory industry:

http://www.passmark.com/forum/memtest86/5903-rowhammer-probl...

http://www.passmark.com/forum/memtest86/5475-memtest86-v6-2-...

Run it on your hardware and if it fails, I think you should definitely complain and get it fixed.

Re: New cloud attack takes full control of virtual machines with little effort

#15

Post by nickpsecurity »

userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

There's CPU's that do memory, integrity checking to contain attacks. They're designed for stoping software and peripheral attacks mainly but consider RAM untrusted. They could probably be modified to deal with the new attacks.

Re: New cloud attack takes full control of virtual machines with little effort

#16

Post by ars »

People are focusing too much on the exact specific attack shown here: Deduplication, modifying a public key, etc. (And proposing solutions like turning off deduplicaiton, checksum, etc.)

But that's just this attack - the fact that they have that much control over memory means there are FAR FAR FAR more possible attacks.

If you can control memory to that level then you are limited only by your imagination.

The only mitigation I can think of at the moment is ECC memory. And shame on Intel for only supporting that on Xeon.

Re: New cloud attack takes full control of virtual machines with little effort

#17

Post by andrewstuart »

frostmatthew wrote: post #3

This attack wouldn't work with [current versions] of ESXi since VMs now share pages only if the salt value and contents of the pages are identical (each VM uses a unique salt by default). https://kb.vmware.com/selfservice/microsites/search.do?langu...

Sharing pages seems a big price risk to pay for saving a little memory.

Why not turn it off entirely?

Re: New cloud attack takes full control of virtual machines with little effort

#18

Post by userbinator »

nickpsecurity wrote: post #15
userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

There's CPU's that do memory, integrity checking to contain attacks. They're designed for stoping software and peripheral attacks mainly but consider RAM untrusted. They could probably be modified to deal with the new attacks.

ECC RAM has been around for a long time and may reduce, but not eliminate the risk. The problem is that the RAM is fundamentally defective.

Re: New cloud attack takes full control of virtual machines with little effort

#19

Post by Afforess »

userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

I don't agree, there is software that is designed to run on faulty hardware. This is often in high radiation environments (see: outer space). I agree this is not an area that much hardening has been done in conventional security models, but in other environments, it is common to use CRC error detection, parity information or other means to ensure that even if data is partially corrupted, that the original can be restored.

I see no reason to prevent someone from implementing this sort of error correction for GPG and other important cryptography.

Re: New cloud attack takes full control of virtual machines with little effort

#20

Post by [deleted] »

andrewstuart wrote: post #17
frostmatthew wrote: post #3

This attack wouldn't work with [current versions] of ESXi since VMs now share pages only if the salt value and contents of the pages are identical (each VM uses a unique salt by default). https://kb.vmware.com/selfservice/microsites/search.do?langu...

Sharing pages seems a big price risk to pay for saving a little memory. Why not turn it off entirely?

[deleted]
Post reply on HN