Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New cloud attack takes full control of virtual machines with little effort

arstechnica.com

Post reply on HN
Print view View original

61–70 of 105 posts

Re: New cloud attack takes full control of virtual machines with little effort

#61

Post by willvarfar »

makomk wrote: post #57
willvarfar wrote: post #52

Earlier quoted context omitted.

Encrypted RAM is offered by the newest Intel server-grade CPUs (SGX, Skylake) and the next AMD server-grade CPUs (SME, Zen). One of the main use-cases for these technologies is trusted computing in a cloud environment - the customer can assert that the hardware is securing the program state from the eyes of the computer owner!. However, the cloud is actually made from cheap commodity boxes without server-grade anythi…

Don't think I've seen any non-server-grade processors in even the cheapest bargain-basement VPS hosts. (Low-end dedicated is different.) Cramming as many VMs into a big server as possible seems to be too important to their cost structure for that.

We perhaps only disagree on what is "server-grade" vs what is sold for servers.

Google, for example, are famous for making big data centres out of cheap commodity boxes, and I double Amazon are any different. I certainly know the rackspace blades I've played with didn't make my grade of either! :)

Re: New cloud attack takes full control of virtual machines with little effort

#62

Post by willvarfar »

andrewstuart2 wrote: post #9

It seems the HN title and original title are both pretty wrong, at least according to the article content. The attack vector is really the ability to, if you have a known public key and a server using it, perform a pre-calculated bit flip such that the new public key is much easier to factor, and thus obtain a corresponding private key. So you're not obtaining original private keys, you're altering original public ke…

Another attack would be to flip bits in code pages...

That the attackers illustrated it by changing public keys so they could push updates or ssh into a box doesn't mean that's all the ways they could have compromised. You can't say "I don't use SSH so I'm safe!" or anything like that.

Re: New cloud attack takes full control of virtual machines with little effort

#63

Post by willvarfar »

ploxiln wrote: post #58
runeks wrote: post #42

Ouch. Before reading this article I was seriously considering deploying a signing service as a HaLVM (Haskell) Xen PV unikernel running on EC2. The service would receive its private key after startup, such that the key never touches disk. Now I'm a lot less inclined to pretend that the Xen interface actually protects me...

Xen has had page-table and interrupt vector related security vulnerabilities. But I don't think EC2 would use non-ECC RAM, so I don't think it's vulnerable to this "rowhammer" technique. (I also don't think EC2 would do cross-VM page deduplication, another necessary condition.)

Perhaps we need more certainty than just "think"?

That AWS don't boast that they are not susceptible to this suggests that perhaps at least some of their setup is?

Re: New cloud attack takes full control of virtual machines with little effort

#64

Post by [deleted] »

patrick8 wrote: post #36
niftich wrote: post #22

Earlier quoted context omitted.

> The rowhammer "attack" is successful only because the hardware is just plain broken I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead. This isn't like the 2008 Phenom TLB bug [1] where the CPU was locking up so AMD released a workaround that kept it from fr…

FDIV was really not technically a serious errata in the grand scheme of erratas. The Phenom TLB bug was worse. Intel basically denied/sat on the issue for half a year, stopped just short of slandering Dr. Nicely, etc, they made it into a complete PR disaster. If they came out the week after it was reported and just said, here's a workaround, here's an opt-in replacement program (which they finally did, but then it wa…

[deleted]

Re: New cloud attack takes full control of virtual machines with little effort

#65

Post by besselheim »

walrus01 wrote: post #2

It is more costly, but this is a good reason to use a dedicated chunk of memory for every Xen PV domU. No oversubscription! Allowing multiple domU VMs on the same dom0 (or the equivalent in other hypervisor platforms) to re-use memory and balloon/contract memory on the fly is what enables this.

I suppose this would still be susceptible to this class of attack: https://www.usenix.org/conference/usenixsecurity16/technical...

Unless you're very careful about which ranges of physical memory are mapped to each VM.

Re: New cloud attack takes full control of virtual machines with little effort

#66

Post by wepple »

userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

without being an expert in this area; my gut feel is that the fix to this problem is likely going to be funded by the end user. Given that competition continues to drive prices down, would 'secure ram' be viable? would you pay more for it?

Re: New cloud attack takes full control of virtual machines with little effort

#67

Post by userbinator »

niftich wrote: post #22
userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

> The rowhammer "attack" is successful only because the hardware is just plain broken I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead. This isn't like the 2008 Phenom TLB bug [1] where the CPU was locking up so AMD released a workaround that kept it from fr…

I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead.

I extensively test all the hardware I buy (CPU: LINPACK, RAM: MemTest86+) and if it fails any of those tests, it gets returned as "not fit for purpose". I've done this successfully a few times. A lot of other enthusiasists/power users do the same too, especially if they're overclocking, and searches on other forums show plenty of users testing and finding (mostly other, not rowhammer) errors in newly-bought RAM even when not overclocking. But as noted in the threads I linked to, manufacturers may be trying to cover this up and downplay its severity. Even in the original paper on rowhammer, the authors didn't disclose which manufacturers and which modules were affected, although I think this should really be treated like the FDIV bug: name and shame. I blame political correctness...

Re: New cloud attack takes full control of virtual machines with little effort

#68

Post by wepple »

xorgar831 wrote: post #4

Here's the crux of the memory issue from one of the link in the article: DDR memory is laid out in an array of rows and columns, which are assigned in large blocks to various applications and operating system resources. To protect the integrity and security of the entire system, each large chunk of memory is contained in a "sandbox" that can be accessed only by a given app or OS process. Bit flipping works when a hac…

Rowhammer itself has been around a while, and is only 50% of this attack that has been posted.

The other bit is the newer idea (well, old idea, newer actual implementation); memory deduplication by your hypervisor leads to a very minor timing fingerprint when you write to a page of memory that had previously been deduplicated IE the same physical page was shared amongst multiple VM's because it was identical.. until you wrote to it and the OS/hardware had to then Copy-on-Write it out to your own dedicated copy; that has a higher latency than a memory page that is already available directly for writing to you.

Re: New cloud attack takes full control of virtual machines with little effort

#69

Post by tsukikage »

nickpsecurity wrote: post #35
userbinator wrote: post #18

Earlier quoted context omitted.

ECC RAM has been around for a long time and may reduce, but not eliminate the risk. The problem is that the RAM is fundamentally defective.

I know what the root problem is. I also know it comes from an oligopoly of companies that only care about money, probably have patents on key features, and operate in a price-sensitive market. Fixing root cause might be tricky unless you could be sure via contracts of volume deals from cloud and other big buyers. Meanwhile, small teams in academia are building CPU's that knock out those and other issues. Worth bringi…

You can't entirely blame the providers for only caring about money; the consumers that choose the budget hosting options for critical applications must surely share some of it.

Server grade hardware is certainly available to cloud/VPS providers, but it turns out people are unwilling to pay $2 for a VM if there's one going elsewhere for $1.50.

Re: New cloud attack takes full control of virtual machines with little effort

#70

Post by userbinator »

wepple wrote: post #66
userbinator wrote: post #14

The rowhammer "attack" is successful only because the hardware is just plain broken , and I consider it in the same category as things like a CPU which will calculate 1+1=3 if the computation of 1+1 is done enough times --- nothing software should even try to fix, because the problem is at a lower level. The solution is to demand that the hardware manufacturers make memory which actually works like memory should; and…

without being an expert in this area; my gut feel is that the fix to this problem is likely going to be funded by the end user. Given that competition continues to drive prices down, would 'secure ram' be viable? would you pay more for it?

Given that competition continues to drive prices down, would 'secure ram' be viable? would you pay more for it?

It's funny you mention this, since the problem only affects newer DDR3 and DDR4 modules and older RAM (EDO modules are apparently still in limited production and being sold) does tend to be significantly more expensive. Unfortunately the rest of the hardware needs to be compatible.

This also means all the older hardware that gets scrapped in massive quantities daily is likely to contain RAM immune to this problem, which is somewhat ironic... maybe it's just a (sad) continuation of the "newer is more volatile" trend that can be traced back to thousand-year-old stone tablets which remain readable today.

Post reply on HN