Researchers' use of a 'Jackhammer' exploit has shown again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.
January 3, 2020
2 Min Read
Rowhammer is the name of a group of hardware-based attacks that focus on the memory of a computer. Researchers have known since the middle of the last decade that doing a high-rate repeated reading of a data cell inside a memory chip can have deleterious effects on the contents of the cell due to the electrical design of the chip.
Over the years, researchers have been able to extend the initial Rowhammer exploit, getting varied outcomes to occur such as adapting to hardware changes done by manufacturers, altering data, hijacking systems and exfiltrating data from victim machines.
It's about to get worse. Researchers have brought out their Jackhammer.
The Jackhammer paper describes how the Floating Point Gate Array (FPGA) chip that is used to accelerate certain computational tasks can also give rise to a Rowhammer-style attack, which it can do with greater efficiency than other CPU-based Rowhammer exploits. This is because the FPGA can repeatedly access the memory system substantially faster than a host machine's CPU can.
FPGAs can also directly access a machine's CPU cache along with the RAM memory. This is the architectural advantage of where they are placed in a system, and gives them the ability to speed up computations without having to go through intermediate software layers like an operating system.
The researchers realized that CPU-FPGA hybrids were here and growing (especially in cloud instances), and they needed to have a security evaluation. They chose Intel's Arria 10 GXFPGA as an example of the current generation of FPGA accelerator platform that had been designed in particular for heavy and/or cloud-based computation loads.
So, they used it as a test platform. The researchers were able to conduct Rowhammer-style ("Jackhammer") exploits against an RSA implementation embedded in an SSL protocol. The researchers found that they could grab the private keys that were used to secure SSL connections with this technique.
They also found that using custom FPGAs to implement the Rowhammer exploit would cause far more of the "bit flips" that they wanted to see. A FPGA can hit the data cell faster and more often than a CPU can do it meaning the FPGA causes more results to occur during an attack. It all goes faster when an FPGA is used.
And as a side benefit, no trace of all this is left on the CPU because it's never touched when an FPGA is used.
That right there means new thinking at the hardware level needs to be done about FPGA-CPU hybrids. Monitoring of the RAM in a system may be necessary to ensure its integrity. Other hardware tricks will no doubt be needed.
Jackhammer shows again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.
— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.
Read more about:Security Now
About the Author(s)
Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange. His first Mac had 128 KB of memory, which was a big step up from his first 1130, which had 4 KB, as did his first 1401. You can e-mail him at [email protected].
You May Also Like
A screen displaying many different types of charts and graphs to show what data is being analyzed.Cybersecurity Analytics