RAMBleed Attack – Reading Bits in Memory Without Accessing Them
1–10 of 141 posts
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#2Why does every new attack have a homepage these days?
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#3If I understood correctly, this is orders of magnitude worst that RowHammer, as it is kind of passive: you set some program to do the RowHammer side, within its own memory space, and then use RAMBleed to see changes from memory cells, not exactly the ones that were RowHammered. Is that it ?
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#4Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive.
Allow me to save some time, from TFA:
> Is there a CVE number?
> Yes, see CVE-2019-0174 [1].
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0174
---
> What is RAMBleed?
> Previous attacks exploited the Rowhammer effect to write (or flip) bits in the victim's memory. RAMBleed is different in that it uses Rowhammer for reading data stored inside the computer's physical memory. As the physical memory is shared among all process in the system, this puts all processes at risk.
> What data can be read by RAMBleed?
> While the end-to-end attack we demonstrated read out OpenSSH 7.9's RSA key, RAMBleed can potentially read any data stored in memory. In practice, what can be read depends on the victim program's memory access patterns.
> What technologies are affected by RAMBleed?
> RAMBleed relies on Rowhammer-induced bit flips to read privileged memory. As such, any system that uses Rowhammer-susceptible DIMMs is vulnerable. Previous research has demonstrated bit flips on both DDR3 and DDR4 with TRR (targeted row refresh) enabled. While we demonstrated our attack on a desktop machine and an ECC enabled server machine, Rowhammer attacks have been demonstrated against both mobile devices and laptops. As such, we suspect that many classes of computers are susceptible to RAMBleed.
> How can I mitigate this issue?
> Users can mitigate their risk by upgrading their memory to DDR4 with targeted row refresh (TRR) enabled. While Rowhammer-induced bit flips have been demonstrated on TRR, it is harder to accomplish in practice.
> Memory manufacturers can help mitigate this issue by more rigorously testing for faulty DIMMs. Furthermore, publicly documenting vendor specific TRR implementations will facilitate a stronger development process as security researchers probe such implementations for weaknesses.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#5Why does every new attack have a homepage these days?
Ever reported a security vulnerability to a company and had it severely downplayed before?
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#6Why does every new attack have a homepage these days?
Came here to ask the same.
Then thought about it and was expecting to see a comment saying “it’s so that normal people understand the vulnerabilities.”
And then I realized it’s probably also because of a desire to be seen. (It seems all participants are from academia?)
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#7Why does every new attack have a homepage these days?
I forget if heartbleed was the first one to a have a homepage or the first one to have a catchy name, but it was to help with the public relations angle of convincing CIOs or their equivalents in an organization to take the problem seriously AFAIK. Someone else here can probably answer it better.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#8Why does every new attack have a homepage these days?
I imagine these researchers are proud of their findings and want to promote their work and their own personal brands. Name recognition is a big part of academia. You'll notice a "People" section immediately following the description of the vulnerability.
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#9Does this affect public cloud providers? Can it be used to obtain data from other VMs running on the same host?
Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them
#10I find it very amusing that they use the name "Feng Shui" for placing the victim page.
For those who don't understand: https://en.wikipedia.org/wiki/Feng_shui