Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google says Rowhammer attacks are gaining range as RAM is getting denser

therecord.media

Post reply on HN
Print view View original

91–100 of 127 posts

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#91

Post by Dylan16807 »

vbezhenar wrote: post #47
notriddle wrote: post #9

In other words, blame Intel for trying to pass off ECC as a "Enterprise Feature" instead of the basic necessity that it is.

Do you think many Ryzen PCs use ECC? I doubt that. It's accepted truth among gamers and power users, that ECC is waste of budget. I don't share this position, but if you'd ask on some computer forums, that's what you'll hear. If ECC would be enabled on all Intel CPUs, nothing fundamentally would change, most users would prefer to save 10% on their RAM.

> It's accepted truth among gamers and power users, that ECC is waste of budget.

A waste of budget at what price?

Are they actually looking at $80 of ram becoming $90, or are they looking at it becoming $160 and slower? Which is about what I see when I go check newegg.

I don't think you can extrapolate current decisions to a world where adding ECC is 12% of the RAM budget and 1-2% of the total budget.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#92

Post by staticassertion »

mhh__ wrote: post #35
atatatat wrote: post #20

Earlier quoted context omitted.

Is there any evidence it's not just a matter of time before there is?

Rowhammer, Spectre, etc. are all very high-information attacks which strike me as not worth the effort for run of the mill adversaries. Three-letter agencies, however, I suspect might have played around with them - if a cloud vendor is secure, and they need a way to un-secure it, they have the resources to get microarchitectural researchers sworn to secrecy to make these attacks work.

TBH I think right now it's more of an incentive thing. Consider that:

a) Attackers would have to develop the POC. This will require a somewhat different skillset than typical exploitation, so there's effort involved.

b) Rowhammer is best for privilege escalation. For desktop users (where the most money is) privesc is already pretty trivial - no need for fancy exploits, you can pretty much just ask for root or use a much more straightforward exploit.

c) Exploit devs don't typically like a lot of attention. You don't want to be the first person selling rowhammer exploits unless you can charge out the ass for it, because you're gonna get way more attention for it.

These incentives aren't super technical, they're mostly market driven, and it's why we don't see fancier attacks in practice, even if they're practical. As one attacker I know was saying to me, they wish they had an excuse to do the fancy thing, but it's never worth the investment when you can own boxes way more easily. Another hacker said "I don't want a Krebs article on me because I did something clever".

NSA's incentives are not super difference, except they're not as directly financial. They also have crazy resources to fuck around with this stuff, so it would make sense that they'd demo it in a lab. Would they actually deploy it? Eh, doubtful. Against another advanced defender rowhammer should be pretty detectable by monitoring ECC metrics, and again, why would you do something fancy when you can just buy 0days - the USG purchases hundreds a year from private companies and develops more themselves.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#93

Post by Dylan16807 »

nightfly wrote: post #50
creato wrote: post #22

Earlier quoted context omitted.

DRAM manufacturers continue (knowingly at this point) to manufacture faulty products, and we should blame Intel?

How many times more expensive would DRAM that is immune to rowhammer cost?

My understanding is that rows in memory chips have thousands of bits in them. If you add 10-20 more to act as a refresh counter, then you can trigger extra refreshes if it gets high enough. Done right, that should give you immunity to rowhammer, while only costing a fraction of a percent in extra die space. And you won't be able to trick it like you can hash-table-based refresh counters.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#94

Post by 6ue7nNMEEbHcM »

marcan_42 wrote: post #74
userbinator wrote: post #71

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

The problem isn't RowHammer, the problem is lack of ECC. This is mostly Intel's fault, as they cripple their consumer CPU lines to disable ECC for market segmentation purposes. The entire premise that we can store tens of gigabytes of information reliably in tiny silicon capacitors without any error detection or correction whatsoever is ludicrous. Every other storage technology uses advanced error correction - NAND F…

Thanks for posting this. I think there isn't much knowledge about ecc among typical customers. I wish at some point ecc would be the norm. The cost doesn't seem high but for any professional PC usage it seems it's necessary.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#95

Post by metiscus »

Dylan16807 wrote: post #90
userbinator wrote: post #80

Earlier quoted context omitted.

ECC is at best a temporary workaround, and at worst an implicit approval of the creation of defective products. It's purpose is to prevent transient bitflips due to cosmic rays and such, not consistently reproducible errors from what is otherwise perfectly normal operation. Plus you can detect attack attempts as the memory controller will report increased error rates. Now you've turned specific access patterns into "…

> I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I don't know about that. Rowhammer really emphasizes the hammer. A normal read pattern will basically never hit the lines in a small area that much, it will hit cache instead. > Now you'…

What if the choice was between a normal stick of ram and a row hammer mitigated stick with double the CAS timing and that cost 50% more? I guess my point is, considering how fundamental to the design and physics of ram, it is unlikely any product designed to mitigate the problem would be equally performant or economic, at least in a medium timeframe.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#96

Post by Dylan16807 »

metiscus wrote: post #95
Dylan16807 wrote: post #90

Earlier quoted context omitted.

> I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I don't know about that. Rowhammer really emphasizes the hammer. A normal read pattern will basically never hit the lines in a small area that much, it will hit cache instead. > Now you'…

What if the choice was between a normal stick of ram and a row hammer mitigated stick with double the CAS timing and that cost 50% more? I guess my point is, considering how fundamental to the design and physics of ram, it is unlikely any product designed to mitigate the problem would be equally performant or economic, at least in a medium timeframe.

I'm much more optimistic. Use target row refresh but do it right. Very low silicon cost, low performance cost under malicious loads, zero performance cost under non-malicious loads.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#97

Post by beebeepka »

staticassertion wrote: post #84
userbinator wrote: post #80

Earlier quoted context omitted.

ECC is at best a temporary workaround, and at worst an implicit approval of the creation of defective products. It's purpose is to prevent transient bitflips due to cosmic rays and such, not consistently reproducible errors from what is otherwise perfectly normal operation. Plus you can detect attack attempts as the memory controller will report increased error rates. Now you've turned specific access patterns into "…

> Now you've turned specific access patterns into "attack attempts", We already have error correction detection available to us and it's in use today. > RAM should always hold what was last written to it, under all conditions of software accesses. OK? That's what anyone who is advocating for ECC is already advocating for . ECC is error correcting up to 1 bit and error detecting up to 2 bits. The goal is to ensure tha…

> RAM 15 years ago was designed completely differently, and had considerably lower capabilities in terms of storage and latency.

You got that backwards, chief. RAM latencies have increased tremendously over the last 15 years.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#98

Post by namibj »

beebeepka wrote: post #97
staticassertion wrote: post #84

Earlier quoted context omitted.

> Now you've turned specific access patterns into "attack attempts", We already have error correction detection available to us and it's in use today. > RAM should always hold what was last written to it, under all conditions of software accesses. OK? That's what anyone who is advocating for ECC is already advocating for . ECC is error correcting up to 1 bit and error detecting up to 2 bits. The goal is to ensure tha…

> RAM 15 years ago was designed completely differently, and had considerably lower capabilities in terms of storage and latency. You got that backwards, chief. RAM latencies have increased tremendously over the last 15 years.

Actual latency has improved, but clock-relative latency hasn't. So what?

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#99

Post by beebeepka »

namibj wrote: post #98
beebeepka wrote: post #97

Earlier quoted context omitted.

> RAM 15 years ago was designed completely differently, and had considerably lower capabilities in terms of storage and latency. You got that backwards, chief. RAM latencies have increased tremendously over the last 15 years.

Actual latency has improved, but clock-relative latency hasn't. So what?

No, actual latencies have been climbing since ddr2. Thanks for the downvote though
Post reply on HN