Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RAMBleed Attack – Reading Bits in Memory Without Accessing Them

rambleed.com

Post reply on HN
Print view View original

111–120 of 141 posts

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#111

Post by ryacko »

mehrdadn wrote: post #108
rsweeney21 wrote: post #80

Shortly after I joined Microsoft in 2004, all new feature work on Windows Longhorn (Vista) was halted. There had been yet another high profile computer virus on Windows XP caused by a buffer overflow. It was an all-hands-on-deck type moment. Everyone spent weeks adding SAL (source-code annotation language) annotations to the entire Windows code base. SAL annotations enabled automated source code analysis to identify…

> SAL annotations Are there tools for developers to use these (e.g. with VC++), or are they all Microsoft internal?

I have read about this: https://github.com/google/styleguide/tree/gh-pages/cpplint

There is also this: https://github.com/mre/awesome-static-analysis

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#112

Post by mehrdadn »

ryacko wrote: post #111
mehrdadn wrote: post #108

Earlier quoted context omitted.

> SAL annotations Are there tools for developers to use these (e.g. with VC++), or are they all Microsoft internal?

I have read about this: https://github.com/google/styleguide/tree/gh-pages/cpplint There is also this: https://github.com/mre/awesome-static-analysis

I was specifically asking about SAL.

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#113

Post by ryacko »

mehrdadn wrote: post #112
ryacko wrote: post #111

Earlier quoted context omitted.

I have read about this: https://github.com/google/styleguide/tree/gh-pages/cpplint There is also this: https://github.com/mre/awesome-static-analysis

I was specifically asking about SAL.

There is also this: https://docs.microsoft.com/en-us/visualstudio/code-quality/u...

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#114

Post by mehrdadn »

ryacko wrote: post #113
mehrdadn wrote: post #112

Earlier quoted context omitted.

I was specifically asking about SAL.

There is also this: https://docs.microsoft.com/en-us/visualstudio/code-quality/u...

I think they talk about the annotation but not the analysis tools?

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#115

Post by infogulch »

deckar01 wrote: post #18
woliveirajr wrote: post #3

If I understood correctly, this is orders of magnitude worst that RowHammer, as it is kind of passive: you set some program to do the RowHammer side, within its own memory space, and then use RAMBleed to see changes from memory cells, not exactly the ones that were RowHammered. Is that it ?

> a bit is more likely to flip when the bits above and below it have the opposite charge. ... To exploit this effect, we developed novel memory massaging techniques to carefully place the victim's secret data in the rows above and below the attacker's memory row. The secret data has to be duplicated, column aligned, and have a single unallocated row between it. Controlling the alignment of the secret data seems like…

So basically we need to defrag our ram now. Here we go again.

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#117

Post by arpa »

aaaaaar wrote: post #71
viraptor wrote: post #66

Earlier quoted context omitted.

Also Snowcrash https://en.wikipedia.org/wiki/Snow_Crash

Another fun one is the Lexicon by Max Barry, except it exploits the auditory language processing. https://www.goodreads.com/book/show/16158596-lexicon

If you're into movies with zombies, pontypool is a fun watch: https://en.m.wikipedia.org/wiki/Pontypool_(film)

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#118

Post by tru3_power »

mehrdadn wrote: post #108
rsweeney21 wrote: post #80

Shortly after I joined Microsoft in 2004, all new feature work on Windows Longhorn (Vista) was halted. There had been yet another high profile computer virus on Windows XP caused by a buffer overflow. It was an all-hands-on-deck type moment. Everyone spent weeks adding SAL (source-code annotation language) annotations to the entire Windows code base. SAL annotations enabled automated source code analysis to identify…

> SAL annotations Are there tools for developers to use these (e.g. with VC++), or are they all Microsoft internal?

Yup there are a few static code analysis tools that support using annotations afaik

Re: RAMBleed Attack – Reading Bits in Memory Without Accessing Them

#120

Post by Dylan16807 »

jiveturkey wrote: post #73
musicale wrote: post #55

Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation. This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK. Hardware in the late 2010s seems a bit like Windows in the late 1990s - a house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay mo…

> This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK. https://en.wikipedia.org/wiki/Row_hammer#Mitigation

"optional hardware support" "some manufacturers"

I think "hasn't generally been fixed" is a fair assessment. TRR is so cheap to implement and should have been made mandatory, with generous safety margins.

Post reply on HN