VUSec

Vrije Universiteit Amsterdam (VU Amsterdam) has a great cybersecurity program. Worth considering. https://www.vusec.net/

As someone who followed a course on all of this, this is indeed how we started out. 1. Read Flush + Reload 2. Then reproduce it in C 3. Then read Meltdown 4. Reproduce it in C 5. Read Spectre 6. Reproduce it in C After that we had to implement a VUSEC paper. I chose GLitch [1]. [1] https://www.vusec.net/projects/glitch/

This is one of two lovely side-channel vulnerabilities in Intel processors released today. Apparently they also leak RDRAND and RDSEED data across cores and took 18 months to fix it: https://www.vusec.net/projects/crosstalk/

This, having the whole physical memory mapped all the time, reminds me of a another issue that was exploitable in KVM hypervisors [1]. I wonder what is the reason to have it all mapped? Not everybody seems to do it. [1] https://www.vusec.net/projects/rain/

Anyone know how this relates to the Training Solo attack that was just disclosed? https://www.vusec.net/projects/training-solo/

AFAIK RowHammer attacks can cause multiple bits to flip in a row[1], no? But sure, it's not for the vast majority of folks. [1]: https://www.vusec.net/projects/eccploit/

Apparently ECC does not prevent this https://www.vusec.net/projects/eccploit/

Hey! One of the authors here. If you prefer we made a short summary of the paper here: https://www.vusec.net/projects/floatzone/ Feel free to ask if you have any doubt

> we've made trade-offs with regards to performance and UX among others Security too! https://www.vusec.net/projects/smash/

I thought ECC wasn’t effective protection against Rowhammer? Agreed that it is incredibly useful otherwise. https://www.vusec.net/projects/eccploit/

I saw this article linked later. https://www.vusec.net/projects/eccploit/ It's interesting! It seems fixable, based on information later on in the article ("Can I get DDR3 DIMMs that are Rowhammer-free?"), and ECC only seems to be part of a solution, and not a complete solution. But you're still right, and I was still wrong: ECC alone isn't good enough.

Yes, Rowhammer can bypass ECC. Forgot to include this in the article, mainly because there's so much Rowhammer research. See here: https://www.vusec.net/projects/eccploit/

> Can Rowhammer bypass ECC and not be detected by an hw_event_mc_err_type? Afaik, yes it can (unless you're counting HW_EVENT_ERR_CORRECTED). They specifically try to get 1 or 3 bit flips, never 2. See here: https://www.vusec.net/projects/eccploit/ (yes, that's the same link)

No. Trivially bypassed without a leak. Two of many examples: https://dl.acm.org/doi/10.5555/3195638.3195686 https://www.vusec.net/projects/anc/ New timing attacks that break ASLR come out ~annually. These are hardware mechanisms that cannot be mitigated by software. ASLR is broken. (Nevermind ROP gadget compilers, etc.)

ECC is not a total solution. https://www.vusec.net/projects/eccploit/

The web site of the researchers says: > Yes, DDIO is enabled transparently by default in all Intel server-grade processors since 2012 (Intel Xeon E5, E7 and SP families). https://www.vusec.net/projects/netcat/

ECC isn't effective mitigation against Rowhammer either. https://www.vusec.net/projects/eccploit/ tl;dr ECC logic can't cope with 'single' errors involving > 2 bits.

This is TLBleed - the reason OpenBSD disabled SMT (HyperThreading). Overview from security researchers: https://www.vusec.net/projects/tlbleed/ Previous discussions: https://news.ycombinator.com/item?id=17389377 https://news.ycombinator.com/item?id=17350278

There are GLSL exploits. "Vulnerability analysis of GPU computing" https://lib.dr.iastate.edu/cgi/viewcontent.cgi?referer=&httpsredir… "Grand Pwning Unit: Accelerating Microarchitectural Attacks with the GPU" https://www.vusec.net/wp-content/uploads/2018/05/glitch.pdf Just two random papers, there are quite a few others. Ah, and as usual when discussing 3D APIs, games console also use their own flavours, XBox is not the exception.

Not very long. Flip Feng Shui does exactly that: a malicious program in a VM can affect another one co-hosted in the same cloud server if the hypervisor uses deduplication: https://www.vusec.net/projects/flip-feng-shui/

Ars, Wired and a bunch of other sites has also reported on this: https://www.vusec.net/2017/02/aslrcache-anc-mmu-sidechannel-breaking-a…

Here's a web page about it: https://www.vusec.net/projects/anc/

Thanks for the interesting historical reference! As you state, this type of problem is not new, and as noted at [1] e.g. Intel have taken this seriously on their Xeon lineup for a while. It's a shame (LP)DDR4 standards did not make Target Row Refresh mandatory. From the FAQ at [2]: I have a phone with LPDDR4 memory. Am I safe against Drammer attacks? Again, we don’t know. Chances are that your DRAM comes with the Target Row Refresh (TRR) mitigation, which makes it harder – but still not impossible, in theory – to induce bit flips. Moreover, TRR for LPDDR4 is optional, so your DRAM manufacturer may have decided to drop this technique and leave you vulnerable. [1] https://en.wikipedia.org/wiki/Row_hammer#Mitigation [2] https://www.vusec.net/projects/drammer/

This reminds me of timing side channel attacks in general. With VUSEC (VU University Amsterdam) we did flush/reload side channel attacks. I don't remember the specifics, I did this in 2018. But yea, basically if a cache hit versus a memory roundtrip will result in different time values, then you can iterate over all 256 bytes (assuming ASCII) and when you have a cache hit for a specific value, the time should be much lower. However, this also assumes you understand cache internals of the specific CPU and it means you need to know when caches fill up, why they fill up and how to do cache eviction. Knowing how to do cache eviction means that you need to know how many elements can be cached, and if I recall correctly that means you need to reverse engineer the cache size of the CPU. But once you can reliable evict values from the cache set and reliably fill them up, then the rough outline I mentioned above is possible. Again, this is like 50% accurate since it has been a long while and I currently work in marketing as a data analyst (I like a mix of fluffy marketing/psychology talk and being deeply technical - if you feel the same way, feel free to reach out. My email is on my profile). There's some of what I described on this website (and a whole bunch more) [1]. I think the reverse engineering of cache lines was specifically in the accompanied paper. [1] https://www.vusec.net/projects/glitch/

wrong. https://www.vusec.net/projects/eccploit/