21–30 of 141 posts
Does this affect public cloud providers? Can it be used to obtain data from other VMs running on the same host?
AMD's SEV might help protecting VMs from each other.
Why does every new attack have a homepage these days?
Perhaps I'm missing something really obvious, but doesn't hardware-provided memory encryption solve this quite handily? You might be able to read single bits of raw physical memory from another process, but this won't tell you anything substantial about what that process is up to.
/sarc but also maybe not
Does this affect public cloud providers? Can it be used to obtain data from other VMs running on the same host?
Why does every new attack have a homepage these days?
I imagine these researchers are proud of their findings and want to promote their work and their own personal brands. Name recognition is a big part of academia. You'll notice a "People" section immediately following the description of the vulnerability.
If I understood correctly, this is orders of magnitude worst that RowHammer, as it is kind of passive: you set some program to do the RowHammer side, within its own memory space, and then use RAMBleed to see changes from memory cells, not exactly the ones that were RowHammered. Is that it ?
> a bit is more likely to flip when the bits above and below it have the opposite charge. ... To exploit this effect, we developed novel memory massaging techniques to carefully place the victim's secret data in the rows above and below the attacker's memory row. The secret data has to be duplicated, column aligned, and have a single unallocated row between it. Controlling the alignment of the secret data seems like…
Honest question, because I'm not a security expert: can you do this without having already pwned your target to such a degree that this would be unnecessary?
Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive. Allow me to save some time, from TFA: > Is there a CVE number? > Yes, see CVE-2019-0174 [1]. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0174 --- > What is RAMBleed? > Previous attacks exploited the Rowhammer effect to write (or flip) bits…
Unless your CEO loves talking about CVEs all day long, I think we should all be grateful for these good-looking marketing campaigns for serious security issues .
But sometimes it seems to be stretched to the point of making you feel nauseated and cause extreme distraction (which can be the point in some cases, though). Still, I wish some of the less egregious issues were described with a little less hysteria, while still conveying their seriousness. (Maybe it's my weariness of dealing with them is speaking here.)
Why does every new attack have a homepage these days?
-- What happens when the cure is worse than the disease (some variants of Spectre), and we "have to" patch because otherwise we're "not secure against this scary sounding thing." It takes a lot of agency away from the IT department to make an informed decision about the appropriate mitigation and threat model, and turns it into a business requirement regardless of the trade-off - because brass "understands" Spectre, they don't understand CVE-1234
-- Or, theoretical exploits that aren't practical in the real world, but we spend a lot of effort or make tradeoffs to fix just because someone needs some material for their PhD.
-- What do you call it when we find another way to read RAM next year - RAMBleed2? I guess.