New research finds “bitflipping” attacks may pose more risk than many admit. Physical weaknesses in memory chips that make computers and servers susceptible to hack attacks dubbed “Rowhammer” are more exploitable than previously thought and extend to DDR4 modules, not just DDR3, according to a recently published research paper.
The paper, titled How Rowhammer Could Be Used to Exploit Weaknesses in Computer Hardware, arrived at that conclusion by testing the integrity of dual in-line memory modules, or DIMMs, using diagnostic techniques that hadn’t previously been applied to finding the vulnerability. The tests showed many of the DIMMs were vulnerable to a phenomenon known as “bitflipping,” in which 0s were converted to 1s and vice versa. The report was published by Third I/O, an Austin, Texas-based provider of high-speed bandwidth and super computing technologies. The findings were presented over the weekend at the Semicon China conference.
“Based on the analysis by Third I/O, we believe that this problem is significantly worse than what is being reported,” the paper warned. “And it is still visible on some DDR4 memory modules.”
Mark Lanteigne, Third I/O CTO and founder, told Ars there’s no immediate danger of Rowhammer being exploited maliciously to hijack the security of computers that use the vulnerable memory chips. Still, he said his assessment presents a significantly less comforting picture than those painted by Samsung, Micron, and other DDR manufacturers. Samsung, he said, has largely declared its DDR4 product line to be “Rowhammer free” because of technology it calls TRR, or targeted row refresh, which makes chips better able to withstand large numbers of malicious accesses that come in rapid succession during the attack. Micron, meanwhile, has also praised the benefits of TRR in its DDR4 products.
To assess the accuracy of the claims, Third I/O employees tested 12 varieties of DDR4 chips, and it didn’t take long for eight of them to succumb to bitflipping. The first DIMM to fall was Crucial Ballistix Sport model manufactured by Micron. Ultimately, the researchers also carried out successful Rowhammer attacks against other Crucial- and Micron-branded DDR4 modules, as well as DIMMs from Geil. Interestingly, DIMMs from G.Skill were able to withstand the tests.
“Although the sample size of memory we tested was very small, we can definitively say that Rowhammer bit flips are most certainly reproducible on DDR4,” the authors wrote.
The researchers were also able to flip the bits inside DDR3 DIMMs installed on an enterprise-grade server. The tests succeeded even though all of the DDR3 modules included a protection known as ECC, short for error-correction code, that’s supposed to make them more resistant to Rowhammer. In many of the cases, the servers completely locked up or spontaneously rebooted, usually within three minutes of the tests commencing. The tests also succeeded when the DIMMs contained an additional Rowhammer defense that doubles the speed at which the chips refresh their memory contents.
In general, the bitflipping attacks work by accessing—or hammering—specific memory locations inside a DIMM millions of times per second. In certain cases, the contents in locations just adjacent to the targeted location will be altered, causing the bits to flip. In a demonstration unveiled last March, members of Google’s Project Zero security research team manipulated the data corruptions in a way that made it possible for an untrusted application to gain nearly unfettered system privileges in one case. In another case, the bit flips made it possible to bypass security sandboxes designed to keep malicious code from accessing sensitive operating system resources. A few months later, researchers showed how the attacks could be carried out using the same JavaScript code most websites rely on to deliver content to end users.
The attacks were highly unusual because they used software to exploit physical weaknesses inside vulnerable DIMMs. While researchers said the attacks potentially introduced new ways attackers might compromise computers, they also noted the demands of the exploit made it extremely hard to carry out in a practice. The difficulty, many researchers have said, is especially significant if memory chip manufacturers introduced defenses, such as reducing the time it takes for DIMMs to refresh their contents and equipping them with ECC. The findings in the new paper raise the possibility some of those assurances may come with important limitations.
The improved success rate at the heart of the paper is the result of a diagnostic tool called Memesis that’s proprietary to Third I/O. It was originally developed to test if a given server was able to support the high-speed Fibre Channel SSD product the company sold. Over time, it became more of general-purpose stress-testing tool. For the new paper, the researchers used Memesis to carry out Rowhammer attack variations that haven’t been publicly tried before, including those with multiple CPU threads that target a small contiguous region of memory.
Unlike many previous Rowhammer attacks, the ones carried out by Third I/O didn’t just hammer targeted regions with all 0s or all 1s. Rather, they subjected DIMMs to a barrage of random data patterns that often proved more efficient. In one case, they stumbled on what they called a “killer data pattern” that in some tests achieved 50 percent more bit flips than a typical pattern. In hexadecimal form, the pattern is:
492492492492492492492492492492492492492492492492
In binary form it translates to:
0100100100100100100100100100100100100100100100100100100100100100 1001001001001001001001001001001001001001001001001001001001001001 0010010010010010010010010010010010010010010010010010010010010010
“We believe that there is likely a killer data pattern specific and unique to every system, but that discovering a single pattern to find more issues on all systems is highly unlikely due to architectural differences,” the authors wrote. “That is why we endorse the use of random data patterns as a default hammering strategy.”
The researchers said the aim of their paper is to demonstrate that risks of bit-flipping attacks remain alive, despite the mitigations manufacturers have already introduced. By showing successful attacks against both DDR3 and DDR4 modules, the industry would do well to pay attention and heed the warning.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
