Re:New cloud attack takes full control of virtual machines w...
by Dylan16807 on Friday September 02, 2016 @04:53AM
(#12411788)
Rowhammer is largely random. You don't get to target specific bits of physical ram. You find scarce weak bits and work to get the data located there. In this case that means you can only pick a couple bits per 4KB to attack. That won't let you fake out a CRC.
Re:New cloud attack takes full control of virtual machines w...
by acobster on Friday September 02, 2016 @10:07AM
(#12413114)
That's where I'm getting a little hazy. The paper says the attacker can "induce bit flips over arbitrary physical memory in a fully controlled way." Sounds a little more advanced than "largely random" to me, and based on the article it sounds like FFS is a step up from "vanilla" Rowhammer...am I missing something?
Re:New cloud attack takes full control of virtual machines w...
by ultramancool on Friday September 02, 2016 @10:54AM
(#12413420)
Yeah, I mean if it won't beat a CRC wouldn't ECC RAM be a reasonably easy solution to this and wouldn't most servers already be secured against it?
Re:New cloud attack takes full control of virtual machines w...
by Dylan16807 on Friday September 02, 2016 @04:18PM
(#12415966)
ECC RAM makes it a harder, but three bit flips will still survive. It depends on whether the system actually acts properly when it sees a huge amount of ECC errors happening.
Re:New cloud attack takes full control of virtual machines w...
by Dylan16807 on Friday September 02, 2016 @04:10PM
(#12415901)
They can pick a bit or two per page to attack, but then they're stuck with those bits.
In theory they could attack a new bit every few minutes, but that requires a system that allows the victim page to be remapped multiple times. KSM does not; any other memory-merging system could work the same way to mitigate things.
Even if they could keep remapping, it's a very slow attack that way. Reloading the checksum every ten minutes would keep you safe.
Rowhammer is too powerful a technique to expect secure software to run on machines affected by it. This is an attack based on using rowhammer to change bits in other VM's memory. The only sane response to that, from the perspective of writing secure software, is despair. You can't deal with attackers in possession of that primitive.