Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RAMBleed Attack – Reading Bits in Memory Without Accessing Them

rambleed.com

Post reply on HN
Print view View original

51–60 of 141 posts

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#51

Post by brianberns »

manifestsilence wrote: post #44
anon_cow1111 wrote: post #24

Well, this sounds really bad. Though on a positive note, I guess we could try a similar exploit in meatspace to figure out if we're living in a simulation or something. /sarc but also maybe not

That's actually a pretty cool thought. I've always scoffed at philosophies along the lines of, "what if it's all a dream/simulation" because if it's perfect, and you only escape it through death, what's the point of holding that view? But if there's a chink in the armor, it becomes suddenly very interesting. Not that I think that's likely to pan out since it so badly violates Occam's Razor, but it's an interesting po…

It might not be as unlikely as you think: https://www.newyorker.com/books/joshua-rothman/what-are-the-...

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#52

Post by cwkoss »

jerf wrote: post #36
CodeMage wrote: post #27

Earlier quoted context omitted.

> Edit: The strategy in the paper requires allocating a bunch of physical memory from all the small blocks so that memory allocation requests from a new process are allocated deterministically to a desired physical row. Honest question, because I'm not a security expert: can you do this without having already pwned your target to such a degree that this would be unnecessary?

Probably not. However, historically, these sorts of attacks always get better, not worse. And while even that can sometimes be empty rhetoric, I will say in the last 5 years I'm seeing a lot of security attacks that are already well beyond what even my moderately-trained intuition would suggest are possible, so I have to admit I've sort of given up on trying to guess on whether or not an attack can be made practical.…

Yeah, it seems that whenever an exploit "doesn't seem practical for actual use" it is just one more exploit-in-the-chain away from being operationalized.

So many systems have unspecified, undocumented and undertested behaviors that have not been exploited only because no one has ever tried.

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#53

Post by lacker »

heybrendan wrote: post #4

Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive. Allow me to save some time, from TFA: > Is there a CVE number? > Yes, see CVE-2019-0174 [1]. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0174 --- > What is RAMBleed? > Previous attacks exploited the Rowhammer effect to write (or flip) bits…

They need to step up their marketing game. They don't even have a Twitter account to promote Rambleed. twitter.com/rambleed isn't taken yet ;-)

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#55

Post by musicale »

Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation.

This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK.

Hardware in the late 2010s seems a bit like Windows in the late 1990s - a house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay more for security and reliability vs. performance/features/new and shiny.

(So if we're lucky then we'll end up with a "more secure" version of hardware that is analogous to... Windows Vista.)

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#56

Post by air7 »

This is a tangent, but I find it (somewhat) annoying when f.a.q's don't answer their own questions. I see this happen occasionally and I always wonder if it's intentional to side-step an issue by raising it yourself, and then answering something else.

> Can RAMBleed be detected by antivirus? > We believe that it is very unlikely that any antivirus software on the market currently detects RAMBleed.

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#57

Post by colechristensen »

musicale wrote: post #55

Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation. This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK. Hardware in the late 2010s seems a bit like Windows in the late 1990s - a house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay mo…

Real-world side channels are going to start getting more attention as the technology and techniques for extracting information from EM radiation from circuits (not radios) leaking state improve.

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#58

Post by arpa »

xamuel wrote: post #45
tptacek wrote: post #11

Earlier quoted context omitted.

It's also an idiom Alex Sotirov coined 10 years ago: https://en.wikipedia.org/wiki/Heap_feng_shui

Imagine if human beings could be vulnerable to such attacks. Someone sends you a video link, you watch it, you see weird shapes appearing and disappearing for a few minutes, then the next thing you know, you wake up in a bathtub full of ice-cubes with one of your kidneys stolen.

Sounds like you'd enjoy https://en.m.wikipedia.org/wiki/BLIT_(short_story)

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#59

Post by uponcoffee »

KenanSulayman wrote: post #6
tathougies wrote: post #2

Why does every new attack have a homepage these days?

Came here to ask the same. Then thought about it and was expecting to see a comment saying “it’s so that normal people understand the vulnerabilities.” And then I realized it’s probably also because of a desire to be seen. (It seems all participants are from academia?)

It's hard to talk about things without names. You could use the CVE but it's hard to remember one from the other and is about the same as using no names.

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#60

Post by hansendc »

segfaultbuserr wrote: post #32
akersten wrote: post #30

I am so torn about the whole vulnerability branding thing. On the one hand, it gives a great amount of visibility and motivation for brass to actually provide for getting prod patched when IT might not have had the political capital to do so otherwise. But on the other hand, I think about things like: -- What happens when the cure is worse than the disease (some variants of Spectre), and we "have to" patch because ot…

> -- What do you call it when we find another way to read RAM next year - RAMBleed2? I guess. or RAMBleed-NG, probably.

It would have made more sense to call this on "RAMbo First Bleed". Next year it can be "RAMbo First Bleed Part II".
Post reply on HN