MESSAGE
| DATE | 2015-03-11 |
| FROM | Elfen Magix
|
| SUBJECT | Re: [NYLXS - HANGOUT] DRAM exploit
|
Peeking and poking into memory to change system values and open up files and programs. I have not done that since the 80s on my Commodore, Atari and Apple systems!
~Fernando
--------------------------------------------
On Wed, 3/11/15, Ruben Safir wrote:
Subject: [NYLXS - HANGOUT] DRAM exploit
To: hangout-at-nylxs.com
Date: Wednesday, March 11, 2015, 4:42 PM
check this out
http://arstechnica.com/security/2015/03/cutting-edge-hack-gives-super-user-status-by-exploiting-dram-weakness/
Cutting-edge hack gives super user status by exploiting DRAM
weakness
"Rowhammer" attack goes where few exploits have gone before,
into
silicon itself.
by Dan Goodin - Mar 10, 2015 3:01 am UTC
134
Enlarge / DDR3 DIMMs like this one are susceptible to a hack
known as
"rowhammering," which alters the contents stored in computer
memory.
Tobias b köhler
In one of more impressive hacks in recent memory,
researchers have
devised an attack that exploits physical weaknesses in
certain types of
DDR memory chips to elevate the system rights of untrusted
users of
Intel-compatible PCs running Linux.
The technique, outlined in a blog post published Monday by
Google's
Project Zero security initiative, works by reversing
individual bits of
data stored in DDR3 chip modules known as DIMMs. Last year,
scientists
proved that such "bit flipping" could be accomplished by
repeatedly
accessing small regions of memory, a feat that—like a
magician who
transforms a horse into a rabbit—allowed them to change
the value of
contents stored in computer memory. The research unveiled
Monday showed
how to fold such bit flipping into an actual attack.
"The thing that is really impressive to me in what we see
here is in
some sense an analog- and manufacturing-related bug that is
potentially
exploitable in software," David Kanter, senior editor of
the
Microprocessor Report, told Ars. "This is reaching down into
the
underlying physics of the hardware, which from my standpoint
is cool to
see. In essence, the exploit is jumping several layers of
the stack."
Getting hammered
DDR memory is laid out in an array of rows and columns,
which are
assigned in large blocks to various applications and
operating system
resources. To protect the integrity and security of the
entire system,
each large chunk of memory is contained in a "sandbox" that
can be
accessed only by a given app or OS process. Bit flipping
works when a
hacker-developed app or process accesses two carefully
selected rows of
memory hundreds of thousands of times in a tiny fraction of
a second. By
hammering the two "aggressor" memory regions, the exploit
can reverse
one or more bits in a third "victim" location. In other
words, selected
zeros in the victim region will turn into ones or vice
versa.
The ability to alter the contents of forbidden memory
regions has
far-reaching consequences. It can allow a user or
application who has
extremely limited system privileges to gain unfettered
administrative
control. From there, a hacker may be able to execute
malicious code or
hijack the operations of other users or software programs.
Such
elevation-of-privilege hacks are especially potent on
servers available
in data centers that are available to multiple customers.
The vulnerability works only on newer types of DDR3 memory
and is the
result of the ever smaller dimensions of the silicon. With
less space
between each DRAM cell, it becomes increasingly hard to
prevent one cell
from interacting electrically with its neighbors. By
repeatedly
accessing one or more carefully selected memory locations,
attackers can
exploit this volatility, causing the charge to leak into or
out of
adjacent cells. With enough accesses, the technique can
change the value
of a cell. The attack doesn't work against newer DDR4
silicon or DIMMs
that contain ECC, short for error correcting code,
capabilities.
Mark Seaborn, described as a "sandbox builder and breaker,"
along with
reverse engineer Thomas Dullien, developed two "rowhammer"
exploits
that, when run as unprivileged processes, were able to gain
kernel
privileges on an x86-64 Linux system. The first exploit ran
as a Native
Client module on top of Google Chrome. Once Google
developers became
aware of the exploit, they disallowed the CLFLUSH
instruction that's
required to make the exploit work. The second exploit, which
ran as a
normal Linux process and gained access to all physical
memory, will be
harder to mitigate on existing machines.
There are other things that made the exploits impressive.
Irene
Abezgauz, a product VP at Dyadic Security and an experienced
penetration
testing professional, told Ars:
The Project Zero guys took on the challenge of
leveraging the
concept of rowhammer into an actual exploit. What's
impressive is the
combination of lots of deep technical knowledge with quite a
bit of
hacker creativity. What they did was create attack
techniques in which
flipping just a single bit in a specific location allows
them to execute
any code they want with root privileges or escape a sandbox.
This is
impressive by itself, but they added to this quite a few
creative
solutions to make it more likely to succeed in a real world
scenario and
not just in the lab. They figured out ways for better
targeting of the
specific locations in memory they needed to flip, improved
the chances
of the attack to succeed by creating ("spraying") multiple
locations
where a flipped bit would make the right impact, and came up
with
several ideas to leverage this into actual privileged code
execution.
This combination makes for one of the coolest exploits I've
seen in a
while.
The attackers didn't identify the specific models of DDR3
that are
susceptible to the attack. While their proof-of-concept
exploits
targeted a Linux computer running x86-64 hardware, the same
technique
would likely work against a variety of platforms.
The results are impressive, but for a variety of reasons
right now, the
attacks appear to be more theoretical than practical. For
one, the
attack appears to allow only local, rather than remote,
exploitation, a
limitation that significantly curtails its appeal to
real-world hackers.
And for another, bit flipping works only against certain
pre-determined
rows. What's more, rowhammering requires more than 540,000
memory
accesses in just 64 milliseconds. Unless refinements are
made, the
demands could make it impractical for attackers to use the
technique to
reliably hijack a system.
Bit flipping shouldn't be mistaken as a class of memory
corruption
exploit, such as a buffer overflow or a use-after-free, both
of which
allow attackers to funnel malicious shell code into
protected regions of
a computer. Rowhammering, by contrast, allows for escalation
of
privileges, which while serious, is a much more nuanced type
of
incursion. Rob Graham, CEO of Errata Security, published
this blog post
that details additional challenges and technical details.
Still, the ability to exploit physical weaknesses in the
hardware is a
highly novel type of attack that breaks new ground and may
not be easy
to remedy.
"This is not like software, where in theory we can go patch
the software
and get a patch distributed via Windows update within the
next two to
three weeks," Kanter, of the Microprocessor Report, said.
"If you want
to actually fix this problem, we need to go out and replace,
on a DIMM
by DIMM basis, billions of dollars' worth of DRAM. From a
practical
standpoint that's not ever going to happen."
|
|
