Approach relies on already installed code, including widely used glibc library. New research into the “Rowhammer” bug that resides in certain types of DDR memory chips raises a troubling new prospect: attacks that use Web applications or booby-trapped videos and documents to trigger so-called bitflipping exploits that allow hackers to take control of vulnerable computers.
The scenario is based on a finding that the Rowhammer vulnerability can be triggered by what’s known as non-temporal code instructions. That opens vulnerable machines to several types of exploits that haven’t been discussed in previous research papers. For instance, malicious Web applications could use non-temporal code to cause code to break out of browser security sandboxes and access sensitive parts of an operating system. Another example: attackers could take advantage of media players, file readers, file compression utilities, or other apps already installed on Rowhammer-susceptible machines and cause the apps to trigger the attacks.
As Ars has previously reported, Rowhammer exploits physical weaknesses in certain types of DDR memory chips to reverse the individual bits of data they store. By repeatedly accessing small regions of memory many times per second, code can change zeroes to ones and vice versa in adjacent regions. These changes occur even though the exploit code doesn’t access, and doesn’t have access rights to, the adjacent regions. The bug took on the name Rowhammer, because when the code figuratively clobbers one or more rows of memory cells, it causes bitflips in a neighboring cell.
The challenge for attackers is hammering the “aggressor row” in a way that changes security-related data stored in the corresponding “victim row.” Early research into the bug found that a code instruction known as CLFLUSH helped in carrying out bitflips that allowed unprivileged processes to break out of the security sandbox in Google’s Chrome browser and attack sensitive operating system resources. A second exploit method required hammering carefully selected DDR rows in a way that was extremely difficult to carry out in practice.
In August, researchers devised a bitflipping method that relied on JavaScript. Rowhammer.js, as the exploit was dubbed, demonstrated what was possible, but it was nonetheless extremely slow, worked on a limited number of platforms, and in most cases succeeded only when a the refresh interval of computer’s processor was manually increased as gamers sometimes do to improve system performance.
A convenient vector
Last week, researchers demonstrated what’s likely the most practical exploit method yet. In a paper titled A New Approach for Rowhammer Attacks, they said already-installed code containing non-temporal instructions can be used to carry out bitflipping attacks that take over the computer or cause it to stop working. The researchers who presented the first Rowhammer attacks in March 2015 had contemplated non-temporal instructions may provide a successful way to perform Rowhammer attacks. The new paper is significant for demonstrating how such an approach can be carried out.
“These findings expose more ways to trigger the DRAM Rowhammer bug, which can lead to data corruption or even security breaches,” Rui Qiao, a PhD student at Stony Brook University and one of the authors of the paper, told Ars. “The described approach could be a convenient vector for attackers, and should be considered when designing or deploying Rowhammer defenses.”
Chrome developers have already responded to the findings by updating the browser security sandbox to block non-temporal store instructions to prevent Rowhammer attacks. Following last year’s unveiling of Rowhammer, the developers similarly barred CLFLUSH instructions.
The results are important because they demonstrate that passing carefully crafted input to a program could allow an adversary to gain full control of the underlying machine, said Daniel Gruss, a PhD student in Graz University of Technology’s Secure Systems group and one of the researchers who devised Rowhammer.js. He said the findings may lead to a time when attackers use booby-trapped video or document files to create bitflips in much the way such files are used to exploit buffer overflows and other software vulnerabilities today. Malicious Web apps could also make use of code already installed on target machines.
Et tu, glibc?
One piece of code cited in the paper is the GNU C Library used in Linux and many other operating systems, and it is linked to virtually all software. Both the memset and memcpy functions available in the library contain the raw materials to carry out bitflipping attacks because they use non-temporal instructions when storing data. Non-temporal instructions store data directly on a DRAM chip, rather than in a computer’s CPU cache, which is orders of magnitude faster. They’re helpful in bringing about Rowhammer-style bitflips because exploits must reliably cause accesses to the DRAM and not the cache.
The researchers say existing apps or code that use non-temporal instructions can be manipulated in several ways. One is for malicious Web apps to invoke the instructions so that exploit code can break out of a browser’s security sandbox. Another is to trick an end user into viewing a malicious video or document that causes the viewer app to carry out the attack.
The threat posed by Rowhammer is probably at least a few years away from being practical. Still, given recent findings that the bug extends to DDR4 memory, not just DDR3 as previously believed, there’s reason for measured concern. Unlike most vulnerabilities, Rowhammer is a physical defect that resides in the hardware itself, so it may not be as easy to fix. While manufacturers are working on measures to prevent Rowhammer attacks, it’s important for them to keep abreast of the latest research to make sure the defenses can’t be bypassed by new techniques.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
