Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

1/3/2020
11:10 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

FPGAs Do It Faster Than CPUs

Researchers' use of a 'Jackhammer' exploit has shown again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.

Rowhammer is the name of a group of hardware-based attacks that focus on the memory of a computer. Researchers have known since the middle of the last decade that doing a high-rate repeated reading of a data cell inside a memory chip can have deleterious effects on the contents of the cell due to the electrical design of the chip.

Over the years, researchers have been able to extend the initial Rowhammer exploit, getting varied outcomes to occur such as adapting to hardware changes done by manufacturers, altering data, hijacking systems and exfiltrating data from victim machines.

It's about to get worse. Researchers have brought out their Jackhammer.

The Jackhammer paper describes how the Floating Point Gate Array (FPGA) chip that is used to accelerate certain computational tasks can also give rise to a Rowhammer-style attack, which it can do with greater efficiency than other CPU-based Rowhammer exploits. This is because the FPGA can repeatedly access the memory system substantially faster than a host machine's CPU can.

FPGAs can also directly access a machine's CPU cache along with the RAM memory. This is the architectural advantage of where they are placed in a system, and gives them the ability to speed up computations without having to go through intermediate software layers like an operating system.

The researchers realized that CPU-FPGA hybrids were here and growing (especially in cloud instances), and they needed to have a security evaluation. They chose Intel's Arria 10 GXFPGA as an example of the current generation of FPGA accelerator platform that had been designed in particular for heavy and/or cloud-based computation loads.

So, they used it as a test platform. The researchers were able to conduct Rowhammer-style ("Jackhammer") exploits against an RSA implementation embedded in an SSL protocol. The researchers found that they could grab the private keys that were used to secure SSL connections with this technique.

They also found that using custom FPGAs to implement the Rowhammer exploit would cause far more of the "bit flips" that they wanted to see. A FPGA can hit the data cell faster and more often than a CPU can do it meaning the FPGA causes more results to occur during an attack. It all goes faster when an FPGA is used.

And as a side benefit, no trace of all this is left on the CPU because it's never touched when an FPGA is used.

That right there means new thinking at the hardware level needs to be done about FPGA-CPU hybrids. Monitoring of the RAM in a system may be necessary to ensure its integrity. Other hardware tricks will no doubt be needed.

Jackhammer shows again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Sure you have fire, but he has an i7!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28636
PUBLISHED: 2021-03-04
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An attacker can provide malicious input to trigger this vulnerability.
CVE-2020-35628
PUBLISHED: 2021-03-04
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability.
CVE-2020-35636
PUBLISHED: 2021-03-04
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume(). An attacker can provide malicious input to trigger this vulnerability.
CVE-2020-8298
PUBLISHED: 2021-03-04
fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
CVE-2020-28601
PUBLISHED: 2021-03-04
A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An attacker can provide malicious input to trigger this vulnerability.