11–20 of 42 posts
my prediction before reading is that they're using the piezo sparker to beat the DUT over the head with a big EMF spike Edit: Nailed it!
I thought they were going to just heat a chip to increase the overall error rate
Yes. We do this in Australia, around the bars and pubs getting a root with only a cigarette lighter is a classic move.
Uh... yeah. Just hold the sysadmins hand over the lighter until they tell you the password. Never forget the easy way in ... the humans.
Earlier quoted context omitted.
If it's intel, you can fry an egg for sure.
The ol' Black MacBook Cooktop...
Uh... yeah. Just hold the sysadmins hand over the lighter until they tell you the password. Never forget the easy way in ... the humans.
- It also works on LPDDR5, LPDDR4
- Yes, it works on ARM platforms (at least, the ones I tried).
- The simplest way to trigger similar faults electronically is via a high-speed mux IC, as described in https://stefan-gloor.ch/ddr5 (chipshouter also works, but is less elegant imho!)
- Yes, you can get webkit addrof/fakeobj primitives like this, although I didn't write an end-to-end exploit.
- You can pwn nintendo switch kernel with an adjusted exploit strategy, but the same adjusted strategy does not work on Switch 2, due to memory encryption (one bitflip corrupts a whole cache line). But other strategies may be possible? (notably, it is possible to block a whole write operation from happening at all - see also https://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was... )
my prediction before reading is that they're using the piezo sparker to beat the DUT over the head with a big EMF spike Edit: Nailed it!
It's not like you can randomly spike stuff and achieve an exploit
Answers to some of the questions at the end, from future me: - It also works on LPDDR5, LPDDR4 - Yes, it works on ARM platforms (at least, the ones I tried). - The simplest way to trigger similar faults electronically is via a high-speed mux IC, as described in https://stefan-gloor.ch/ddr5 (chipshouter also works, but is less elegant imho!) - Yes, you can get webkit addrof/fakeobj primitives like this, although I did…
Yes. We do this in Australia, around the bars and pubs getting a root with only a cigarette lighter is a classic move.