Slashdot Mirror
Rowhammer Attack Can Now Root Android Devices (softpedia.com)
An anonymous reader writes from a report via Softpedia: Researchers have discovered a method to use the Rowhammer RAM attack for rooting Android devices. For their research paper, called Drammer: Deterministic Rowhammer Attacks on Mobile Platforms, researchers tested and found multiple smartphone models to be vulnerable to their attack. The list includes LG Nexus (4, 5, 5X), LG G4, Motorola Moto G (2013 and 2014), One Plus One, HTC Desire 510, Lenovo K3 Note, Xiaomi Mi 4i, and Samsung Galaxy (S4, S5, and S6) devices. Researchers estimate that millions of Android users might be vulnerable. The research team says the Drammer attack has far more wide-reaching implications than just Android, being able to exploit any device running on ARM chips. In the past, researchers have tested the Rowhammer attack against DDR3 and DDR4 memory cards, weaponized it via JavaScript, took over PCs via Microsoft Edge, and hijacked Linux virtual machines. There's an app to test if your phone is vulnerable to this attack. "Rowhammer is an unintended side effect in dynamic random-access memory (DRAM) that causes memory cells to leak their charges and interact electrically between themselves, possibly altering the contents of nearby memory rows that were not addressed in the original memory access," according to Wikipedia. "This circumvention of the isolation between DRAM memory cells results from the high cell density in modern DRAM, and can be triggered by specially crafted memory access patterns that rapidly activate the same memory rows numerous times."
Rowhammer is far worse than the infamous Pentium FDIV bug, but RAM makers have no incentive to fix it.
This is why we can't have nice things.
p.s. Future AI's will probably evolve to make use of hardware bugs like Rowhammer in ways that humans can't even understand.
One of the simplest existing known attacks involves creating an 8MB TypedArray object in JavaScript. This gives you a contiguous virtual address range, which allows you to generate 9 addresses that will be aliased to the same cache line and therefore where 9 sequential writes will trigger an eviction and a write back to RAM. What made this attack now work on mobile devices?
I am TheRaven on Soylent News
Of course this is a terrible bug for most.
On the other hand it would be awesome if one could incorporate this attack into an app that roots the device without needing to connect it to a PC first.
You Android device is ROOTED :-(
A bunch of pasty faced sad sack nerds sitting in a basement want to sound cool and tough, like they've just done a tour in 'Nam. So they don't say "enabled" by javascript, no no no, its "weaponised" with "attack vectors" instead of flaws or holes. Its just so lame and wannabe.
So, how do I test my phone with this uncompiled app?
Lucky I upgra
Does anybody know if this affects Amazon Kindle devices since they are an Android Fork?
time to implement ECC everywhere, period !
it's not like ram is expensive anymore
The second most insightful post on a security article is about some dude with a chip on his shoulder about the verbiage of the article. Where are all the 1337 hax0rz around here that shout and scream when we're discussing soft security topics like the handling of Clinton's mail server? No input from you boys? Not something here we can debunk like some Hollywood misrepresentation of the computer culture?
Come on guys... you're all experts, worked in the field since Babbage moved on, right? Where's your insights now?
I guess you're all saving it for the next article about how "Teh MafiAAAA" wants people to shut off their cellphones before a movie.
Can't wait until it's up on XDA Developers for the S5 from AT&T, which so far hasn't been able to be rooted, and is the phone my work gave me. Sure it's a free phone and it's a work phone... But I wanna put a different ROM on it, dammit.
This sig isn't original enough, it's time to come up with something witty...
No problem with my Asus Zenfone2 with an Intel chip! (I hope)
"Science will win because it works." - Stephen Hawking
This is just another reason why we need to migrate away from DRAM. It's simply at a fundamental level too easy to exploit this way. We need to move to non-volitile memory, which is more power efficient anyway. Hopefully within a few more years the tech will be there.... I'm most excited about the carbon nanotubes, myself.
This weekend I used Win10, everytime I wanted to view a PDF; Edge wanted to be the PDF viewer yet has no usable options for that function.
I was using the computer just to view PDF's, I had to select Open With: select Foxit (which came pre-installed) and 5+ requestor to make it the default PDF viewer, this everytime I opened a PDF.
It's an obtrusive sob that I'm sure threw itself into the hack.
Shouldn't they have called it DRAMP?
So I have to jump through hoops to try to root my S6 and end up giving up and restoring a backup... but this thing can drive by root it? wtf
C and Java are not memory safe, so shit like this happens. Rust is memory safe -- memory bugs are impossible! Google needs to drop dalvik and embrace rust. It's the only way to prevent bugs like this.
/.'ers disagree outnumbering you
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon
take a look at the APK hosts file engine by SuperKendall
APK is kinda right. I've tried his hosts file generating software. It works by bmo
APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience by chihowa
I like your host file system by Karmashock
I find your hosts file admirable by vel-ex-tech
* My code's also recommended & hosted by Malwarebytes' hpHosts - It works doing more for less.
APK
P.S.=> See subject & those quoted /.'ers - want more? apk
blackberry and qnx aren't looking too bad right now!
They are crackers not researchers damn!
What has their skin colour got to do with it?
Also, the correct term is "economically-disadvantaged caucasians".
Can we stop calling these fucktards researchers already? They are crackers not researchers damn!
Yeah, I mean, researchers explain their methodology and publish papers about it! These are just the dumbest criminal hackers that put their names on some paper they published! Can't wait until they go to jail for their criminal deeds which they are obviously waiting do in the future! -_-
Anons need not reply. Questions end with a question mark.
Gee, thanks.
There are lots of people who are stuck on unrootable devices and could really use this.
Pretty sad, isn't it?
but RAM makers have no incentive to fix it
Actually, they do. They can market lower-density, more-expensive-to-manufacture RAM which has spacing or other "rowhammer-protecting design elements" between rows for use in "high- but-not-quite-military-grade-security" applications.
For example, if off-the-shelf equipment would have been approved for a high-security application but for the vulnerability to rowhammer and similar attacks then the product vendor can substitute the more expensive, lower-density, more-secure RAM and sell his product to the customer rather than lose the sale entirely.
As for military-grade applications, I'm not going to pretend to know what their requirements are or how to address them.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I downloaded the app (https://vvdveen.com/drammer/drammer.apk) to check my android devices but it just keeps running and running. Is that a good thing? If there was a problem would it stop and tell me? Thanks
In the case of 64 bit memory channels it is 72 bits for ECC memory.
The *LARGER* problem is that ECC doesn't help with rowhammer attacks because in many cases rowhammer can trigger the same effect without causing the ECC checksum to fail. Meaning that it passes ECC checksumming and continues on running with the (un)intentionally corrupted data.
The core issue here is that DRAM needs to be redesigned to avoid the capability of cacheline flushes causing unexpected behavior in DRAM (as mentioned in previous articles on this, it is specific brands of DRAM from specific manufacturers that fail this way. They need to be redesigned to solve this issue or have their latency specifications changed to take this situation into account and run with reduced performance characteristics that ensure this situation cannot be triggered under even worst case circumstances.)
Meanwhile: Score one for jailbreakers everywhere. And for a blow against Samsung's KNOX, since this could potentially bypass it if you can trigger this situation over Trustzone controlled memory. (Completely defeating the purpose of a secure machine without using seperate and trustworthy batches of DRAM.)
Apparently Intel patented their fix on Oct 31, 2013... the exact same day that Nexus 5 shipped in the US:
https://www.google.com/patents...
Glad to see the industry came together to protect consumers!
After reading over some of the drammer.pdf paper which others have linked to, I must conclude that the S4 was not tested and the S5 and S6 and many others were not found to be vulnerable. I believe the only ARMv8 they tested and found to be vulnerable was the LG G4.