Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

1/3/2020
11:10 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

FPGAs Do It Faster Than CPUs

Researchers' use of a 'Jackhammer' exploit has shown again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.

Rowhammer is the name of a group of hardware-based attacks that focus on the memory of a computer. Researchers have known since the middle of the last decade that doing a high-rate repeated reading of a data cell inside a memory chip can have deleterious effects on the contents of the cell due to the electrical design of the chip.

Over the years, researchers have been able to extend the initial Rowhammer exploit, getting varied outcomes to occur such as adapting to hardware changes done by manufacturers, altering data, hijacking systems and exfiltrating data from victim machines.

It's about to get worse. Researchers have brought out their Jackhammer.

The Jackhammer paper describes how the Floating Point Gate Array (FPGA) chip that is used to accelerate certain computational tasks can also give rise to a Rowhammer-style attack, which it can do with greater efficiency than other CPU-based Rowhammer exploits. This is because the FPGA can repeatedly access the memory system substantially faster than a host machine's CPU can.

FPGAs can also directly access a machine's CPU cache along with the RAM memory. This is the architectural advantage of where they are placed in a system, and gives them the ability to speed up computations without having to go through intermediate software layers like an operating system.

The researchers realized that CPU-FPGA hybrids were here and growing (especially in cloud instances), and they needed to have a security evaluation. They chose Intel's Arria 10 GXFPGA as an example of the current generation of FPGA accelerator platform that had been designed in particular for heavy and/or cloud-based computation loads.

So, they used it as a test platform. The researchers were able to conduct Rowhammer-style ("Jackhammer") exploits against an RSA implementation embedded in an SSL protocol. The researchers found that they could grab the private keys that were used to secure SSL connections with this technique.

They also found that using custom FPGAs to implement the Rowhammer exploit would cause far more of the "bit flips" that they wanted to see. A FPGA can hit the data cell faster and more often than a CPU can do it meaning the FPGA causes more results to occur during an attack. It all goes faster when an FPGA is used.

And as a side benefit, no trace of all this is left on the CPU because it's never touched when an FPGA is used.

That right there means new thinking at the hardware level needs to be done about FPGA-CPU hybrids. Monitoring of the RAM in a system may be necessary to ensure its integrity. Other hardware tricks will no doubt be needed.

Jackhammer shows again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Inside North Korea's Rapid Evolution to Cyber Superpower
Kelly Sheridan, Staff Editor, Dark Reading,  12/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29565
PUBLISHED: 2020-12-04
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the...
CVE-2020-5675
PUBLISHED: 2020-12-04
Out-of-bounds read issue in GT21 model of GOT2000 series (GT2107-WTBD all versions, GT2107-WTSD all versions, GT2104-RTBD all versions, GT2104-PMBD all versions, and GT2103-PMBD all versions), GS21 model of GOT series (GS2110-WTBD all versions and GS2107-WTBD all versions), and Tension Controller LE...
CVE-2020-29562
PUBLISHED: 2020-12-04
The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVE-2020-28916
PUBLISHED: 2020-12-04
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
CVE-2020-29561
PUBLISHED: 2020-12-04
An issue was discovered in SonicBOOM riscv-boom 3.0.0. For LR, it does not avoid acquiring a reservation in the case where a load translates successfully but still generates an exception.