Live data from Hacker News

Google says Rowhammer attacks are gaining range as RAM is getting denser

therecord.media

101–110 of 127 posts

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#101
post #98

Earlier quoted context omitted.

Actual latency has improved, but clock-relative latency hasn't. So what?

No, actual latencies have been climbing since ddr2. Thanks for the downvote though

This article from Crucial probably explains the two arguments: https://www.crucial.com/articles/about-memory/difference-bet... But their conclusion is that practical latency has indeed decreased over the last 15 years.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#102

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

Rowhammer does not really happen in real life scenarios, because if you access the same block of memory multiple times it usually gets cached in L1, L2 or L3 cache. You really have to try to induce such a magnetic field in RAM. The things you're referring to are probably from other sources of random bit flips, such as cosmic radiation.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#103
Though ECC is a must in DDR5 spec. We still need a physical version of ASLR to mitigate this. Ideally, we can make Rowhammer even not practical for Denial of Service. For example, running a full-speed attack for an hour only has a 0.01% chance to flip a bit.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#104

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

The problem isn't RowHammer, the problem is lack of ECC. This is mostly Intel's fault, as they cripple their consumer CPU lines to disable ECC for market segmentation purposes. The entire premise that we can store tens of gigabytes of information reliably in tiny silicon capacitors without any error detection or correction whatsoever is ludicrous. Every other storage technology uses advanced error correction - NAND F…

> The problem isn't RowHammer, the problem is lack of ECC. This is mostly Intel's fault, as they cripple their consumer CPU lines to disable ECC for market segmentation purposes.

Whilst Intel did play a part, when they offered it as standard the uptake in the consumer market was low and the price factor and need at most consumer level was not there.

Today it is there, though the consumer mindset is unaware of it and I do foresee a time in which either some in-the-wild exploit that makes media traction and they roll with it event. Then there will be a sudden panic rush with media rhetoric akin to the run-up to Y2K and drama headlines how everybody needs to buy a new computer. Now if that happened - Intel on the desktop would sure take a wack as it is currently.

Then the whole supply and demand aspect that factors into the cost and alas - until there is some mass consumer awareness.

Well, until then for the majority consumers, computer memory is just computer memory and for most of those, they don't even look into things like memory speed or dual-channel memory even. Which see's your DELL's et all selling systems with one large stick of RAM even today as your average consumer just don't know any better. So the move to ECC for consumers will need en event or large player marketing it. Maybe a balance of the two.

Just the aspect of size of memory today in computers, let alone density and speeds, bit errors become far more likely and that is without the security aspects at play. So for stability alone ECC is becoming more and more justifiable.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#105

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

Rowhammer does not really happen in real life scenarios, because if you access the same block of memory multiple times it usually gets cached in L1, L2 or L3 cache. You really have to try to induce such a magnetic field in RAM. The things you're referring to are probably from other sources of random bit flips, such as cosmic radiation.

[deleted]

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#106
post #75

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

> no known cases Is there any way to get a sense for how meaningful this is? Like, is it a pretty sure bet that no attack has happened? Or, if an attack has happened, it's likely been targeted state-sponsored? Or, is it every time you deploy on a multi-tenant host (e.g., ec2), you're playing Russian roulette?

[deleted]

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#107
post #101

Earlier quoted context omitted.

No, actual latencies have been climbing since ddr2. Thanks for the downvote though

This article from Crucial probably explains the two arguments: https://www.crucial.com/articles/about-memory/difference-bet... But their conclusion is that practical latency has indeed decreased over the last 15 years.

After looking at the table, I am ready to swallow my pride. Looks like practical latencies have changed a tiny bit. So me and the person I replied to originally were both wrong

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#108

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

> ot on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter,

Transient bugs are some of the worst bugs out there. Erlangs approach of crashing + restarting seems to make sense after all. (I used to think that such cases would not exist at all, but have been proven wrong time and time again. It also can make sense for cases such as dropped connection)

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#109
post #101

Earlier quoted context omitted.

This article from Crucial probably explains the two arguments: https://www.crucial.com/articles/about-memory/difference-bet... But their conclusion is that practical latency has indeed decreased over the last 15 years.

After looking at the table, I am ready to swallow my pride. Looks like practical latencies have changed a tiny bit. So me and the person I replied to originally were both wrong

Also note that practical non-high-capacity DDR4 setups reach 3600 CL16. That's way faster than the 3200 CL22 they gave at the bottom.

Re: Google says Rowhammer attacks are gaining range as RAM is getting denser

#110
post #75

But while there are no known cases where Rowhammer attacks have been used in the real world Not on purpose but I'm sure that either it or phenomenon like it are the causes of a lot of odd "glitchy" behaviour that people encounter, because systems are run so close to their limits that there are bound to be cases when they surpass the limits. I remember many years ago discovering that a system which passed the CPU and…

> no known cases Is there any way to get a sense for how meaningful this is? Like, is it a pretty sure bet that no attack has happened? Or, if an attack has happened, it's likely been targeted state-sponsored? Or, is it every time you deploy on a multi-tenant host (e.g., ec2), you're playing Russian roulette?

Cloud hosting (ec2) will use ECC ram on the baremetal hosts, which make this already impractical exploit basically impossible.
Post reply on HN