Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

1/3/2020
11:10 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

FPGAs Do It Faster Than CPUs

Researchers' use of a 'Jackhammer' exploit has shown again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.

Rowhammer is the name of a group of hardware-based attacks that focus on the memory of a computer. Researchers have known since the middle of the last decade that doing a high-rate repeated reading of a data cell inside a memory chip can have deleterious effects on the contents of the cell due to the electrical design of the chip.

Over the years, researchers have been able to extend the initial Rowhammer exploit, getting varied outcomes to occur such as adapting to hardware changes done by manufacturers, altering data, hijacking systems and exfiltrating data from victim machines.

It's about to get worse. Researchers have brought out their Jackhammer.

The Jackhammer paper describes how the Floating Point Gate Array (FPGA) chip that is used to accelerate certain computational tasks can also give rise to a Rowhammer-style attack, which it can do with greater efficiency than other CPU-based Rowhammer exploits. This is because the FPGA can repeatedly access the memory system substantially faster than a host machine's CPU can.

FPGAs can also directly access a machine's CPU cache along with the RAM memory. This is the architectural advantage of where they are placed in a system, and gives them the ability to speed up computations without having to go through intermediate software layers like an operating system.

The researchers realized that CPU-FPGA hybrids were here and growing (especially in cloud instances), and they needed to have a security evaluation. They chose Intel's Arria 10 GXFPGA as an example of the current generation of FPGA accelerator platform that had been designed in particular for heavy and/or cloud-based computation loads.

So, they used it as a test platform. The researchers were able to conduct Rowhammer-style ("Jackhammer") exploits against an RSA implementation embedded in an SSL protocol. The researchers found that they could grab the private keys that were used to secure SSL connections with this technique.

They also found that using custom FPGAs to implement the Rowhammer exploit would cause far more of the "bit flips" that they wanted to see. A FPGA can hit the data cell faster and more often than a CPU can do it meaning the FPGA causes more results to occur during an attack. It all goes faster when an FPGA is used.

And as a side benefit, no trace of all this is left on the CPU because it's never touched when an FPGA is used.

That right there means new thinking at the hardware level needs to be done about FPGA-CPU hybrids. Monitoring of the RAM in a system may be necessary to ensure its integrity. Other hardware tricks will no doubt be needed.

Jackhammer shows again how one problem can be exploited in many ways, with each iteration of an attack becoming faster and more efficient.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/13/2020
Where Are the 'Great Exits' in the Data Security Market?
Dave Cole, Cofounder and CEO, Open Raven,  10/13/2020
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15256
PUBLISHED: 2020-10-19
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and settin...
CVE-2020-15261
PUBLISHED: 2020-10-19
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administr...
CVE-2020-6084
PUBLISHED: 2020-10-19
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malic...
CVE-2020-6085
PUBLISHED: 2020-10-19
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malic...
CVE-2020-10746
PUBLISHED: 2020-10-19
A flaw was found in Infinispan version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.