Slashdot Mirror
Researchers Warn Linux Vendors About Cloud-Memory Hacking Trick (thestack.com)
An anonymous Slashdot reader writes:
Hacking researchers have uncovered a new attack technique which can alter the memory of virtual machines in the cloud. The team, based at Vrije Universiteit, Amsterdam, introduced the attack, dubbed Flip Feng Shui (FFS)...and explained that hackers could use the technique to crack the keys of secured VMs or install malicious code without it being noticed...
Using FFS, the attacker rents a VM on the same host as their chosen victim. They then write a memory page which they know exists on the vulnerable memory location and let it de-duplicate. The identical pages, with the same information, will merge in order to save capacity and be stored in the same part of memory of the physical computer. This allows the hacker to change information in the general memory of the computer.
The researchers demonstrated two attacks on Debian and Ubuntu systems -- flipping a bit to change a victim's RSA public key, and installing a software package infected with malware by altering a URL used by apt-get. "Debian, Ubuntu and other companies involved in the research were notified before the paper was published, and have all responded to the issue."
Using FFS, the attacker rents a VM on the same host as their chosen victim. They then write a memory page which they know exists on the vulnerable memory location and let it de-duplicate. The identical pages, with the same information, will merge in order to save capacity and be stored in the same part of memory of the physical computer. This allows the hacker to change information in the general memory of the computer.
The researchers demonstrated two attacks on Debian and Ubuntu systems -- flipping a bit to change a victim's RSA public key, and installing a software package infected with malware by altering a URL used by apt-get. "Debian, Ubuntu and other companies involved in the research were notified before the paper was published, and have all responded to the issue."
Remember when stuff like this broke here?
Looks folks, I know you wanted to save cash for your trips to private islands and jet planes, but sometimes you just have to pony up. Trying to have your shit hosted on a 3rd party platform is foolish. There are more important things than saving a quick buck because you didn't want to buy infrastructure. Welp Too bad.
OK, I get the deduplication part to save capacity. But aren't those deduped pages supposed to be treated in CoW manner?
It is "just" a rowhammer based attack. It the RAM is defective, it should be replaced.
FFS: I like these researchers. They know a good acronym when they see one.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Thank GOD your IT people researched this BEFORE the time was spent. Good thing I don't use the investment firm, or your services. Thank you for your time.
Enron, is that you!?
That is probably the funniest thing I've ever read.
are you going to spam this on every /. article?
You only have to give source to those people you give the binaries to.
Unless you're giving your precious binaries to your competitors, you don't have to give them the source either.
As far as that bit about gcc goes, that's just pure bullshit and no self respecting lawyer attach his name to it.
A Pirate and a Puritan look the same on a balance sheet.
cloud = hosting by 3rdparty (Score:?)
by Anonymous Coward on Sunday August 14, 2016 @02:51PM
wellllllll ...DO HOSTING YOURSELF
have a nce fbi day.
5 minute dleay eh , so mght as well type random bullshit while m here mispell as much as possible and basically go jack off then return type some more and hten go shower and eat and then ...then hit submit
only site i know that does this...guess the fbi have limited resources
You failed to confirm you are a human. Please start from the beginning and try again. If you are a human, we apologize for the inconvenience.
Yes, otherwise it wouldn't be funny. See every other /. troll meme for reference. At least this one isn't racist, sexist or homophobic and actually is fairly funny, unlike the modern apping app appers guy. Or APK.
It's clearly a joke post, Admiral Aspergers. LOL @ replying seriously to trollbait.
Hmm, its a bit difficult to believe that no one figured out before the project what GPL meant, but as this was in the finance industry which gave us the recent banking crisis maybe its not, since not having a f*cking clue is subsidised by the taxpayer why would you need to understand what you are doing?.
Windows 7/OpenBSD/MacOSX/Server 2008 R2 and later use virtual ram addresses that are scrambled to prevent this and injections. This is one of the oldest cracker techniques in the book after buffer overflows. Linux doesn't have this?
http://saveie6.com/
Israel hacked your brain dude, get a replacement.
You forgot the $799 per core SCO licensing in your email
http://saveie6.com/
Except against laptops, that is often easy as they use too slow refresh-cycles to safe power. That makes rowhammer very easy.
But I have yet to find a credible example of it working _at_ _all_ against correctly refreshed memory.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
No, no, no! Only if you publish the new kernel that you made are you required
to provide the source and the changes you have made. If you keep it totally
in-house, there is no requirement to release _anything_.
Let's say you modify the kernel to work in some widget you're going to market and sell.
When you sell the widget that runs your enhanced kernel, the GPL requires you to
make your enhancements available in source form. But if your kernel enhancements
are used by the company coffee making machine *internally*, those changes are not
required to be "released." Of course, it's always good to contribute to the community,
but it's not a requirement under those circuimstances.
Sorry, but your lawyers did not understand what they read in the GPL.
CAP === 'hitter'
OK, I know you're trolling, but in case anyone is stupid enough to believe you:
From Wikipedia's ASLR page:
History
The Linux PaX project first coined the term "ASLR", and published the first design and implementation of ASLR in July 2001. It is seen as the most complete implementation, providing also kernel stack randomization since October 2002. Compared to other implementations, it is also seen to provide the best layout randomization.
My pics.
How does the attacker know what memory pages are what in the targets VM space? That seems like quite a trick. Or is Amazon sharing various pages among all machines that are known to the public somehow? I am not a cracker myself so I don't really get how the attacker has this information.
... doesn't mean you have to try to elicit that response from us.
"Ahh! I see you're in that indeterminate Schrodinger state where - oh, uh
Isn't that an old hat? I remember when row hammer came out there was a big warning about not using shared pages in VMs because it would allow exactly this kind of manipulation. Same goes for all manner of cache attacks that only work with shared pages.
So what exactly is new here? Did they just show that what everybody said is possible really is possible?