Slashdot Mirror
Researchers Warn Linux Vendors About Cloud-Memory Hacking Trick (thestack.com)
An anonymous Slashdot reader writes:
Hacking researchers have uncovered a new attack technique which can alter the memory of virtual machines in the cloud. The team, based at Vrije Universiteit, Amsterdam, introduced the attack, dubbed Flip Feng Shui (FFS)...and explained that hackers could use the technique to crack the keys of secured VMs or install malicious code without it being noticed...
Using FFS, the attacker rents a VM on the same host as their chosen victim. They then write a memory page which they know exists on the vulnerable memory location and let it de-duplicate. The identical pages, with the same information, will merge in order to save capacity and be stored in the same part of memory of the physical computer. This allows the hacker to change information in the general memory of the computer.
The researchers demonstrated two attacks on Debian and Ubuntu systems -- flipping a bit to change a victim's RSA public key, and installing a software package infected with malware by altering a URL used by apt-get. "Debian, Ubuntu and other companies involved in the research were notified before the paper was published, and have all responded to the issue."
Using FFS, the attacker rents a VM on the same host as their chosen victim. They then write a memory page which they know exists on the vulnerable memory location and let it de-duplicate. The identical pages, with the same information, will merge in order to save capacity and be stored in the same part of memory of the physical computer. This allows the hacker to change information in the general memory of the computer.
The researchers demonstrated two attacks on Debian and Ubuntu systems -- flipping a bit to change a victim's RSA public key, and installing a software package infected with malware by altering a URL used by apt-get. "Debian, Ubuntu and other companies involved in the research were notified before the paper was published, and have all responded to the issue."
Remember when stuff like this broke here?
Looks folks, I know you wanted to save cash for your trips to private islands and jet planes, but sometimes you just have to pony up. Trying to have your shit hosted on a 3rd party platform is foolish. There are more important things than saving a quick buck because you didn't want to buy infrastructure. Welp Too bad.
OK, I get the deduplication part to save capacity. But aren't those deduped pages supposed to be treated in CoW manner?
It is "just" a rowhammer based attack. It the RAM is defective, it should be replaced.
FFS: I like these researchers. They know a good acronym when they see one.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Hello,
As a consultant for several large companies, I'd always done my work on
Windows. Recently however, a top online investment firm asked us to do
some work using Linux. The concept of having access to source code was
very appealing to us, as we'd be able to modify the kernel to meet our
exacting standards which we're unable to do with Microsoft's products.
Although we met several technical challenges along the way
(specifically, Linux's lack of Token Ring support and the fact that we
were unable to defrag its ext2 file system), all in all the process
went smoothly. Everyone was very pleased with Linux, and we were
considering using it for a great deal of future internal projects.
So you can imagine our surprise when we were informed by a lawyer that
we would be required to publish our source code for others to use. It
was brought to our attention that Linux is copyrighted under something
called the GPL, or the Gnu Protective License. Part of this license
states that any changes to the kernel are to be made freely available.
Unfortunately for us, this meant that the great deal of time and money
we spent "touching up" Linux to work for this investment firm would
now be available at no cost to our competitors.
Furthermore, after reviewing this GPL our lawyers advised us that any
products compiled with GPL'ed tools - such as gcc - would also have to
its source code released. This was simply unacceptable.
Although we had planned for no one outside of this company to ever
use, let alone see the source code, we were now put in a difficult
position. We could either give away our hard work, or come up with
another solution. Although it was tough to do, there really was no
option: We had to rewrite the code, from scratch, for Windows 2000.
I think the biggest thing keeping Linux from being truly competitive
with Microsoft is this GPL. Its draconian requirements virtually
guarantee that no business will ever be able to use it. After my
experience with Linux, I won't be recommending it to any of my
associates. I may reconsider if Linux switches its license to
something a little more fair, such as Microsoft's "Shared Source".
Until then its attempts to socialize the software market will insure
it remains only a bit player.
Thank you for your time.
cloud = hosting by 3rdparty (Score:?)
by Anonymous Coward on Sunday August 14, 2016 @02:51PM
wellllllll ...DO HOSTING YOURSELF
have a nce fbi day.
5 minute dleay eh , so mght as well type random bullshit while m here mispell as much as possible and basically go jack off then return type some more and hten go shower and eat and then ...then hit submit
only site i know that does this...guess the fbi have limited resources
You failed to confirm you are a human. Please start from the beginning and try again. If you are a human, we apologize for the inconvenience.
Debian is high traffic and that includes a of other devices, including QNAP Network Attached Storage devices. (NAS)
Part of their umbrella surveillance for not only the US but globe includes your home devices, even beyond Windows.
US Spy Agencies are trying to be everywhere, and have the US bankrupt at the same time. This is intended to leave Americans with no choice but to engage in treason WITH THEM.
The problem is that Israel is competition. While the spy agencies carry on with 9/11 false flag etc.. the Jews and Israel have intentionally taken control of the Federal Reserve, the entire mass media, much of the Internet including Facebook, and many other key corportations.
Intentional.
So Bernie Sanders is their guy. If he is elected President of the United States that would make him Commander in Chief of the US Armed Forces. This would be even more conjunct with Israel's own military disposition. Presently Israel lives under a missile shield known as the Iron Dome. They also have as a fallback plan something called the "Samson Option". You can look them up on wikipedia.
The problem with Israel's plan is that if you take the American Military and subject them to Bernie Sanders / Israeli mindset... you have the #1 military superpower on Earth with the "Samson Option". Stupid? yeah.
A lot of the scare is about oil on both sides. With America already bankrupt how will the US have oil without military and money?
There is also no such thing as a multi-national nation.
Windows 7/OpenBSD/MacOSX/Server 2008 R2 and later use virtual ram addresses that are scrambled to prevent this and injections. This is one of the oldest cracker techniques in the book after buffer overflows. Linux doesn't have this?
http://saveie6.com/
Except against laptops, that is often easy as they use too slow refresh-cycles to safe power. That makes rowhammer very easy.
But I have yet to find a credible example of it working _at_ _all_ against correctly refreshed memory.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
OK, I know you're trolling, but in case anyone is stupid enough to believe you:
From Wikipedia's ASLR page:
History
The Linux PaX project first coined the term "ASLR", and published the first design and implementation of ASLR in July 2001. It is seen as the most complete implementation, providing also kernel stack randomization since October 2002. Compared to other implementations, it is also seen to provide the best layout randomization.
My pics.
How does the attacker know what memory pages are what in the targets VM space? That seems like quite a trick. Or is Amazon sharing various pages among all machines that are known to the public somehow? I am not a cracker myself so I don't really get how the attacker has this information.
... doesn't mean you have to try to elicit that response from us.
"Ahh! I see you're in that indeterminate Schrodinger state where - oh, uh
Isn't that an old hat? I remember when row hammer came out there was a big warning about not using shared pages in VMs because it would allow exactly this kind of manipulation. Same goes for all manner of cache attacks that only work with shared pages.
So what exactly is new here? Did they just show that what everybody said is possible really is possible?