Slashdot Mirror
Rowhammer Attacks Can Now Bypass ECC Memory Protections (zdnet.com)
Catalin Cimpanu, reporting for ZDNet: Academics from the Vrije University in Amsterdam, Holland, have published a research paper this week describing a new variation of the Rowhammer attack. For readers unfamiliar with the term, Rowhammer is the name of a class of exploits that takes advantage of a hardware design flaw in modern memory cards. By default, a memory card stores temporary data inside storage units named cells, which are arranged on the physical silicon chip in multiple rows, in the form of a grid. [...] In research [PDF] published today, named ECCploit, academics expanded the previous Rowhammer techniques with yet another variation. This one, they said, bypasses ECC memory, one of the memory protections that hardware makers said could detect and prevent Rowhammer attacks in the past.
ECC stands for Error-Correcting Code and is a type of memory storage included as a control mechanism with high-end RAM, typically deployed with expensive or mission-critical systems. ECC memory works by protecting against rogue bit flips, like the ones caused by Rowhammer attacks. Surprisingly, it wasn't developed to deal with Rowhammer. It was initially developed in the 90s to protect against bit flips caused by alpha particles, neutrons, or other cosmic rays, but when Rowhammer came out, it also proved to be effective against it, as well. But after spending months reverse engineering the designs of ECC memory, the Vrije University team discovered that this protection mechanism has its limits.
ECC stands for Error-Correcting Code and is a type of memory storage included as a control mechanism with high-end RAM, typically deployed with expensive or mission-critical systems. ECC memory works by protecting against rogue bit flips, like the ones caused by Rowhammer attacks. Surprisingly, it wasn't developed to deal with Rowhammer. It was initially developed in the 90s to protect against bit flips caused by alpha particles, neutrons, or other cosmic rays, but when Rowhammer came out, it also proved to be effective against it, as well. But after spending months reverse engineering the designs of ECC memory, the Vrije University team discovered that this protection mechanism has its limits.
That thing was on the wire two days ago. And "published today" but still linking a draft? What?
as being able to bypass ECC Memory Protections.
It has been possible all along, it is just that someone has publicly proved that the theoretical vulnerability is an actual vulnerability. VERY important difference from title, since this could have allowed the compromise of servers since DDR3 came out and maybe even further back (although the glitches allowing this were only proven in certain brands of DDR3 early on. I have not heard whether it is now ALL DDR3, or still only certain DDR3 lithography processes.
Assumed DDR4 is also compromised until you hear otherwise, and for anything that needs security, only run buffered ram, which is believed resistant if not immune to the attack.
We could be treated to another BeauHD "Russia! Russia! Russia!" rant.
That would be worse, much worse.
So when are they gonna start releasing "patches" for this that knock another 30-50% off my machine speed, in addition to what I've already lost due to mandatory Meltdown mitigations?
Doesn't Address Space Layout Randomisation basically make this impractical?
https://en.wikipedia.org/wiki/...
The fact that servers normally utilize ECC RAM is probably the main reason this didn't blow up into a Spectre-style fiasco. I expect plenty of scrambling, in addition to slowdowns in VMs attempting to detect Rowhammer exploits. Rowhammer resistance for DRAM might be developed now, just like how Spectre resistance was a bullet point for the latest Intel CPUs, which is good since consumer devices were left vulnerable to Rowhammer.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
It would but that is a little like killing a fly with a bazooka. it is simple but updating your host file is a pain
Unregistered ECC is basically only ever used on consumer grade chips. Registered memory is supported on anything server grade, and is usually cheaper than unregistered for the same capacity.
The concern here is it means systems that DO support unregistered ECC, specifically AMD 939-AM4 systems and 115x series Xeons/Pentiums are now proven susceptible to rowhammer attacks, which means unless you keep them isolated from the possibility of exploits or running unverified remote code (like javascript), they can be hacked from even unprivileged user code without any software exploits on the system itself.
How else can know if hammered? Is louder than fans? Does chunk plastic show inside case?
Only if it is written in Rust.
I have a very vague notion about how row hammer operates but it's really vague. COuld someone explain it both in terms of how it works, how one gets sidechannel information from being able to flip the bits, and then, pratically, how one makes a nefarious use out of spotty info.
Some drink at the fountain of knowledge. Others just gargle.
row hammer being possible means memory has a bad design. any and all patterns should be able to be changed as quickly as possible in ram without affecting adjacent positions. the compromises made to make row hammer possible are due to incompetence, compromises were made that make a design unreliable
We need more researchers to replicate these studies. They do not seem to do this and it is suspicious because one company would seem to benefit here.
That tells the parent nothing about how information is transferred. That was a non answer.
No it's not a data corruption issue. The use as a DoS attack is a trivial use case. It's used to affect security too.
Alpha Particles.. Lol... This author did not do his homework.. I piece of paper can stop an Alpha Particle... No way is an Alpha going to penetrate all the matter surrounding the memory silicon..
If you want to play this game of unlimited AC posts, then I have unlimited mod points.
Usually I don't bother because your shit is too funny.
ZIP
gweihir KNOWS u IMPERSONATE me https://it.slashdot.org/commen... c6gunner proves it https://linux.slashdot.org/com... he forgot to SUBMIT as AC & using his registered 'lusrname' instead (because he tried to mock me both BEFORE & after I FAIRLY challenged him to show he's done better work - he had ZERO).
& NO WAY I'd "cry" like you "playing victim ne'er-do-wells" on /. (TROLL /.ers, not all) OR post on hosts offtopic.
YOU HELPED ME https://science.slashdot.org/c... (& you quit trying to make me look bad trying to "tell lies" on hosts as "ME" IN YOUR IMPERSONATIONS of me e.g. https://tech.slashdot.org/comm... as regards Intel speculative execution attack? Hosts PREVENT 'EM)
APK
P.S.=> I KNOW the 2nd to last link above's KILLING YOU - YOU ACTUALLY HELPED ME getting me to see if hosts stop more than portsmash (& Meltdown + Spectre too) & "lo & behold" - hosts WORK on 'em - U LOSE... apk
"Not as clumsy/random as a blaster - An elegant weapon 4 a more civilized age" https://it.slashdot.org/commen...
* "For over a 1,000 generations Jedi Knights were guardians of peace & justice in the old Republic. Before the dark times. Before the EMPIRE"
(NOT "wannabe weapons" of TROLL shitlords on /. like ZIP https://it.slashdot.org/commen... - theirs = effete downmods I RUN 'EM DRY OF & lies & WHY they LOSE).
APK
P.S.=> Many here know https://linux.slashdot.org/com... & enjoy greater speed/security/reliability & anonymity hosts yield natively speeding you up 2 ways (adblocks & hardcodes that protect vs. DNS security issues in redirect poisoning + request tracking logs & RESOLVE FASTER locally from RAM driven by KERNELMODE speed vs. slow usermode in "solutions" packed w/ security issues (DNS/Antivirus) OR not working fully by default (adblock) in usermode addons easily detected by webmasters & blocked doing less but using more)... apk
The real issue is that ECC memory is so expensive that it is not often used. It should be used everywhere.
A few extra bits should only cost a few extra percent. But the price triples because it is considered a fancy server feature.
I suspect many system crashes and unrepeatable bugs are due to rare random memory errors. I had once buggy memory and it was maddening until sorted. And memory thrashers never found the issue.
Operating systems should get very upset at more than a few correctable ECC errors, closing down pages of memory, error messages to users etc. But they probably don't.
Was always curious why rowhammer still works after scramblers built into current day memory controllers. They explain some of the reason it still works on page 10.
S|TME (total memory encryption) should be completely effective against these types of problems in future hardware.