Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New cloud attack takes full control of virtual machines with little effort

arstechnica.com

Post reply on HN
Print view View original

21–30 of 105 posts

Re: New cloud attack takes full control of virtual machines with little effort

#21

Post by ams6110 »

andrewstuart wrote: post #17
frostmatthew wrote: post #3

This attack wouldn't work with [current versions] of ESXi since VMs now share pages only if the salt value and contents of the pages are identical (each VM uses a unique salt by default). https://kb.vmware.com/selfservice/microsites/search.do?langu...

Sharing pages seems a big price risk to pay for saving a little memory. Why not turn it off entirely?

I would guess if you're a big VM hosting provider and you have thousands of VMs all running the same version of Windows or Linux distro, that it could add up to some real savings to have them share common pages.

Re: New cloud attack takes full control of virtual machines with little effort

#22

Post by niftich »

userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

> The rowhammer "attack" is successful only because the hardware is just plain broken

I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead.

This isn't like the 2008 Phenom TLB bug [1] where the CPU was locking up so AMD released a workaround that kept it from freezing at the expense of a 14% performance penalty. This is like the floating point division bug [2] where the device no longer meets basic operational and accuracy guarantees. RAM cells bleeding into each other ought to be considered a fatal flaw, not some intellectual curiosity.

[1] http://techreport.com/review/13741/phenom-tlb-patch-benchmar...

[2] https://en.wikipedia.org/wiki/Pentium_FDIV_bug

Re: New cloud attack takes full control of virtual machines with little effort

#23

Post by andrewstuart »

ams6110 wrote: post #21
andrewstuart wrote: post #17

Earlier quoted context omitted.

Sharing pages seems a big price risk to pay for saving a little memory. Why not turn it off entirely?

I would guess if you're a big VM hosting provider and you have thousands of VMs all running the same version of Windows or Linux distro, that it could add up to some real savings to have them share common pages.

I guess so.

Seems the savings would be somewhat offset by having your whole business destroyed because its easy to crack.

Re: New cloud attack takes full control of virtual machines with little effort

#24

Post by andrewstuart »

ars wrote: post #16

People are focusing too much on the exact specific attack shown here: Deduplication, modifying a public key, etc. (And proposing solutions like turning off deduplicaiton, checksum, etc.) But that's just this attack - the fact that they have that much control over memory means there are FAR FAR FAR more possible attacks. If you can control memory to that level then you are limited only by your imagination. The only mi…

What can you do to attack other VMs if you don't have shared memory with them?

Re: New cloud attack takes full control of virtual machines with little effort

#25

Post by mjevans »

ars wrote: post #16

People are focusing too much on the exact specific attack shown here: Deduplication, modifying a public key, etc. (And proposing solutions like turning off deduplicaiton, checksum, etc.) But that's just this attack - the fact that they have that much control over memory means there are FAR FAR FAR more possible attacks. If you can control memory to that level then you are limited only by your imagination. The only mi…

That used to be a point in AMD's favor for their desktop CPUs.

Re: New cloud attack takes full control of virtual machines with little effort

#26

Post by userbinator »

DigitalJack wrote: post #11
andrewstuart2 wrote: post #9

It seems the HN title and original title are both pretty wrong, at least according to the article content. The attack vector is really the ability to, if you have a known public key and a server using it, perform a pre-calculated bit flip such that the new public key is much easier to factor, and thus obtain a corresponding private key. So you're not obtaining original private keys, you're altering original public ke…

It's the sort of thing for which the NSA would spend their resources to develop an exploit tool.

Rowhammer is such a subtle effect and very easily blamed on many other things that it's not hard for the more paranoid among us to imagine the NSA deliberately sabotaging memories with it to use as a backdoor. When it was first discovered I wrote my thoughts on it here:

https://news.ycombinator.com/item?id=8716977

Re: New cloud attack takes full control of virtual machines with little effort

#27

Post by jerf »

Afforess wrote: post #19
userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

I don't agree, there is software that is designed to run on faulty hardware. This is often in high radiation environments (see: outer space). I agree this is not an area that much hardening has been done in conventional security models, but in other environments, it is common to use CRC error detection, parity information or other means to ensure that even if data is partially corrupted, that the original can be rest…

Hostile environments attack your software without intelligence. (When working with them, it may seem otherwise, but that's just cynicism.) Hostile people attack intelligently. Whatever mitigation you may imagine is possible by checking CRCs or something after the fact, you must account for the possibility that the software, the OS, or the CRC has also been attacked by a hostile intelligent adversary. The fact that we can make reliable software in the face of unintelligent attacks is not evidence that we can make secure software in the face of intelligent ones.

Rowhammer is too powerful a technique to expect secure software to run on machines affected by it. This is an attack based on using rowhammer to change bits in other VM's memory. The only sane response to that, from the perspective of writing secure software, is despair. You can't deal with attackers in possession of that primitive.

Re: New cloud attack takes full control of virtual machines with little effort

#28

Post by dboreham »

niftich wrote: post #22
userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

> The rowhammer "attack" is successful only because the hardware is just plain broken I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead. This isn't like the 2008 Phenom TLB bug [1] where the CPU was locking up so AMD released a workaround that kept it from fr…

Back in the day, when I were a hardware engineer, we called this "pattern sensitivity" and it was a defect!

Re: New cloud attack takes full control of virtual machines with little effort

#29

Post by jerf »

andrewstuart wrote: post #23
ams6110 wrote: post #21

Earlier quoted context omitted.

I would guess if you're a big VM hosting provider and you have thousands of VMs all running the same version of Windows or Linux distro, that it could add up to some real savings to have them share common pages.

I guess so. Seems the savings would be somewhat offset by having your whole business destroyed because its easy to crack.

Conceptually, it's safe. UNIX distributions routinely do the equivalent operation within single machines, it's a fundamental part of their operating model.

It's just that in the face of defective hardware, it's not safe. But this is not surprising, because nothing is safe, so it isn't particularly a criticism of page sharing. This specific attack may have used it, but Rowhammer is a powerful tool. This is not the only way it can be used; it is merely an exemplar.

Re: New cloud attack takes full control of virtual machines with little effort

#30

Post by kccqzy »

caf wrote: post #13
quickben wrote: post #10

Earlier quoted context omitted.

Something like Perspectives for Firefox?

No, much simpler - store a checksum alongside public keys in places like .ssh/authorized_keys, and have the software like sshd recompute the checksum of the in-memory key each time it uses it for authentication. The attack relies on glitching the in-memory key.

This doesn't sound correct. What if the attacker times the operation so that the bit corruption occurs after the checksumming but before being actually used for cryptographic operations?
Post reply on HN