Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

61–70 of 103 posts

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#61

Post by tedunangst »

datenwolf wrote: post #20
pdpi wrote: post #12

Earlier quoted context omitted.

Can you get killed as a result of privilege escalation? The law hasn't caught up in part because the potential consequences aren't nearly as dire.

Modern medical technology relies heavily on computers and software. Take an infusion pump for example. Controlled by a microcontroller and using software. Or insulin pumps; and some vendors are actually considering to add Bluetooth to insulin pumps, so that patients using such a pump can check its status on their smartphone (or on the upcomming smart watches). Also you can adjust the infusion rate of an insulin pump…

If somebody is running their ramhammer exploit on your insulin pump, it's probably a bit late.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#62

Post by tedunangst »

Aissen wrote: post #19

Very little information on time scales. In one case they speak about 5 minutes vs 40 minutes (both might be acceptable for an exploit). Also no information about how long it took to bitflip in their per-hardware table. And why name no hardware vendor ? I'm guessing they expect people to use the tool they provided and draw their own conclusions, but I don't understand why they'd treat them differently from software ve…

A vulnerability in the Windows kernel is going to exist in all Windows kernels of the same version. One laptop with bad RAM doesn't mean all similar models have bad RAM.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#63

Post by mintplant »

aselzer wrote: post #8
0x0 wrote: post #4

Does anyone know if Macbooks are known to be affected?

Seems like my Macbook Air 2014 is not affected (with a high probability) here's the test: https://github.com/google/rowhammer-test

> The test should work on Linux or Mac OS X, on x86 only.

No x86_64 support?

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#64

Post by yuhong »

MichaelGG wrote: post #55
yuhong wrote: post #46

Earlier quoted context omitted.

Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people Really? I think the latest Haswell can go to 16GB just fine if there are two SO-DIMM slots.

There are 16GB SODIMMs, so why isn't Intel supporting those? The company that makes them claims this is purely on Intel/OEMs. 1: http://www.intelligentmemory.com/dram-modules/ddr3-so-dimm/ Update: Oh wow, the new Broadwell chips do support them. So maybe the new ThinkPad X250 isn't so useless after all! This is great news if true.

Intelligent Memory's are probably too expensive for the normal laptop market. Micron claims to be sampling them now: http://www.micron.com/products/dram-modules/sodimm/DDR3%20SD...

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#65

Post by AceJohnny2 »

tenfingers wrote: post #59
otakucode wrote: post #57

Earlier quoted context omitted.

If they did so... the fallout would be interesting. Does anyone know what proportion of modern memory has this flaw? Would it result in tens of thousands of customers returning stick after stick of DRAM until they were able to get a reliable one?

memtest86 has this feature in beta, and it's already generating some heat. I would be personally more interested in this test on memtest86+ though.

What's the difference between memtest86 and memtest86+?

OK, from WP [1]: "Memtest86 was developed by Chris Brady. After Memtest86 remained at v3.0 (2002 release) for two years, the Memtest86+ fork was created by Samuel Demeulemeester to add support for newer CPUs and chipsets. As of November 2013 the latest version of Memtest86+ is 5.01."

And the original has become a commercial program by PassMark. So I think at this point if anyone is talking about memtest86, they're likely referring to the still open-source '+' version.

[1] http://en.wikipedia.org/wiki/Memtest86

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#66

Post by Animats »

ChuckMcM wrote: post #21

Once again, I pine for ECC memory on my Laptop. I know you can get ECC SODIMMS, I got 16GB worth for a Supermicro ITX motherboard. And while the paper talks about multi-bit errors getting through ECC (which is certainly possible with enough flips) single flips causing alerts and double flips causing halts would really get your attention that something bad was happening. As opposed to silently sitting there while my m…

Intel cripples their "consumer grade" processors by locking out the ECC DRAM interface. This forces server vendors to buy "server grade" processors. There, you get all the good error-correction stuff.[1] The fraction of die space devoted to these features is small; there's no reason they couldn't be provided on all x86 family CPUs. It's purely a market positioning thing.

AMD leaves the ECC hardware enabled on most of their parts.

[1] http://www.intel.com/content/dam/www/public/us/en/documents/...

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#68

Post by yuhong »

MichaelGG wrote: post #55
yuhong wrote: post #46

Earlier quoted context omitted.

Intel intentionally nerfed Haswell and newer core i's, presumably to push their Xeons on more people Really? I think the latest Haswell can go to 16GB just fine if there are two SO-DIMM slots.

There are 16GB SODIMMs, so why isn't Intel supporting those? The company that makes them claims this is purely on Intel/OEMs. 1: http://www.intelligentmemory.com/dram-modules/ddr3-so-dimm/ Update: Oh wow, the new Broadwell chips do support them. So maybe the new ThinkPad X250 isn't so useless after all! This is great news if true.

http://techreport.com/discussion/27928/intel-xeon-d-brings-b... mentions 16GB per UDIMM.

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#69

Post by Dylan16807 »

upofadown wrote: post #23

Is a memory error actually an exploit? If so then are the unwanted changes that occur with no deliberate action an example of the computer cracking itself? Philosophical...

Everything is a memory error on some level.

Back to grounding in reality, a way to reliably[1] break security measures is an exploit. Cosmic ray bit flips are anything but reliable.

[1]The threshold of reliability being somewhere below "instant and always" and somewhere above "one in a million if you give it a day to try".

Re: Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges

#70

Post by makomk »

bri3d wrote: post #53
sharkbot wrote: post #32

There was an older paper discussing using various methods of fault injection (heat, voltage changes, etc) to attack Java smart cards, essentially destroying the type system guarantees and thus opening up an attack surface: "The Sorcerer’s Apprentice Guide to Fault Attacks", https://eprint.iacr.org/2004/100.pdf

Fault injection is also how older Dish Network and DirecTV smart cards were hacked - there used to be a cottage industry selling "voltage glitchers" to reprogram Dish Network smart cards with the keys for additional programming tiers.

I believe some pay TV smartcard hacks also made use of clock glitching, basically sending a shorter-than-usual clock pulse that means some of the internal signals don't make it to their destinations on time. The pay TV hacking industry had some pretty clever tricks a decade or two ago.
Post reply on HN