ECC is vulnerable to Rowhammer.

I saw this article linked later. https://www.vusec.net/projects/eccploit/

It's interesting! It seems fixable, based on information later on in the article ("Can I get DDR3 DIMMs that are Rowhammer-free?"), and ECC only seems to be part of a solution, and not a complete solution.

But you're still right, and I was still wrong: ECC alone isn't good enough.

I mean the punchline is: if you heat something up enough then you can get electrons to wiggle. At some level of cell wall thickness, the cost/time/annoyance of triggering a rowhammer exceeds the value of the attack, and other methods become cheaper or more practical.

Ultimately, nothing that an attacker has physical access to can be completely secured, we can only raise the cost in terms of time and money to attempt to breach the system. Even a system with tamper-destructive enclosures have seen attacks (it's just more expensive and difficult than other attacks).

In short, the more annoying/expensive you can make it to attack your system, the smaller the set of attackers becomes.

We are not talking about physical attacks. Neither are we talking about attacks based purely on heating up the DRAM chips. The topic here is a remote attacker who can target specific words or bits to be flipped.

When bits are flipped in a row hammer attack, what is happening to the dram? Most people would argue the energetic potential is increasing causing a failure of the boundary between cells...

Much less so.

Row hammer is already super impractical. ECC does make the exploit harder.

Equally vulnerable?

The same way that masks don't prevent COVID.

Right in statistically mostly it does / they do.

No, statistically it’s almost useless to prevent yourself from getting COVID. It’s mainly about reducing your ability to spread it.

That’s why people get mad when you don’t wear a mask even if you “don’t care about getting covid”.

Yes that was a prominent theory at one time and helped a lot of the public adopt masks but it is actually both https://www.npr.org/sections/health-shots/2020/11/11/9339038...

Do you think many Ryzen PCs use ECC? I doubt that. It's accepted truth among gamers and power users, that ECC is waste of budget. I don't share this position, but if you'd ask on some computer forums, that's what you'll hear. If ECC would be enabled on all Intel CPUs, nothing fundamentally would change, most users would prefer to save 10% on their RAM.

> It's accepted truth among gamers and power users, that ECC is waste of budget.

A waste of budget at what price?

Are they actually looking at $80 of ram becoming $90, or are they looking at it becoming $160 and slower? Which is about what I see when I go check newegg.

I don't think you can extrapolate current decisions to a world where adding ECC is 12% of the RAM budget and 1-2% of the total budget.

The price of ECC is artificially inflated because it's not available to consumers.

At minimum ECC will cost you an extra 12.5% for the extra bit of RAM. That part is not inflated.

Yeah I wasn't trying to imply it would cost nothing to add ECC.

I don't use it on mine, but my Ryzen PC is my gaming box.. Where the impact from such things is very limited.

But ECC RAM is a lot more than 10% more expensive. This is part of the problem. Intel pushes it into a high-end niche which puts it in a much more expensive category, and it also loses economy of scale.

Not sure about PCs, but my Ryzen laptop (HP EliteBook 835 G6) seems to use the AMD technology for memory encryption, with per-boot keys. This is not ECC, but also good enough to counteract RowHammer, because the attacker cannot target specific bits.

I use it on my Ryzen PC, but I am also running ZFS, and I'm a little paranoid about using my data.

This is one anecdote, though, so it's probably not useful. But people using ECC on Ryzen do exist.

Agreed. Rowhammer is just one more example of this, but it's frustrating that ECC is not widely deployed.

DRAM manufacturers continue (knowingly at this point) to manufacture faulty products, and we should blame Intel?

Yes.

Intel is an industry leader. EFI, Thunderbolt, and the "ultrabook" product category are all their ideas. By adding a feature to their CPU products, they induce demand for anything that complements it.

By putting ECC support into their highest-end mobile CPUs only, they made them into high-end luxuries instead of industry standard. https://ark.intel.com/content/www/us/en/ark/search/featurefi...

As others have mentioned, ECC is nothing more than a bandaid for what is ultimately a defective product.

I don't think that's true at all. ECC wasn't designed specifically with this attack in mind, and it's still a pretty effective mitigation.

There's nothing defective about RAM, it's never going to be the case that errors won't happen, it's just that before we were worried about heat and radiation and now we have to worry about attackers too.

The Ultrabook brand was Intel's idea but I'm pretty sure it was created to make sure that the Wintel ecosystem could stay competitive with the MacBook Air.

That doesn’t explain Apple and the M1 though.

I am not familiar with DRAM spec sheets, but are manufacturers specifying that there will be zero errors?

Without a specification that says so, I don't think it's necessarily the fault of the manufacturer if they cannot build perfect RAM!

Suppose someone builds a car with one these computers in a safety-critical role, and then someone gets injured because of an error that "originated" with the RAM.

They specify timing and when it is followed, RAM should work without fault.

But if there are corner cases like this, they should be added to specs. Most likely it would require memory controller to remember last addresses and insert delays if rowhammer attempt is detected. And/or make CPU microoperation scheduler avoid it. No idea how expensive would that be, surely nontrivial.

There are already measures like that where the memory controller attempts to identify "victim rows" and refresh them, but attacks can fool the victim row detection and succeed anyway.

If my car's spec doesn't say "the wheels stay on" and then the wheels fall off, the car is still defective.

The true safety-critical stuff is far from ordinary and would never use commodity DRAM.

They could include ECC but it wouldn't work on most systems so why would they bother?

At least on AMD it works these days.

How many times more expensive would DRAM that is immune to rowhammer cost?

Not an expert, but I feel like the answer is not much. ECC RAM is not, to my knowledge, considerably more expensive to produce - the reason it costs more is because it only works with specific devices, so it's more of a market cost.

ECC RAM is pretty effective as-is against rowhammer, and imo you could very likely tweak ECC's approach to get even further.

The 'worst case' solution wouldn't be more than 2x, right? Since you'd just have to keep a clone of RAM, but obviously shuffled so that the same errors wouldn't occur in the same places. So 2x seems like the sort of absurd upper bound, but I feel like we could do a lot better.

My understanding is that rows in memory chips have thousands of bits in them. If you add 10-20 more to act as a refresh counter, then you can trigger extra refreshes if it gets high enough. Done right, that should give you immunity to rowhammer, while only costing a fraction of a percent in extra die space. And you won't be able to trick it like you can hash-table-based refresh counters.

Mid 2008 or so I think was when rowhammer-prone DRAM started appearing, so consider the density of that DRAM compared to today.