bk99.de entertain the web since 1997

bk99.de
CCC · Hardware securityCurated

Rowhammer.js: Hardware faults from the browser

Summary

Clémentine Maurice and Daniel Gruss show how repeated memory accesses cause DRAM bit flips and how even JavaScript can become a hardware-level attack surface. Rowhammer.js demonstrated a remote, software-induced hardware fault from JavaScript. Abstraction boundaries do not prevent attacks on shared physical resources.

Ideas

  • Frequent accesses to DRAM rows can flip bits in neighbouring rows.
  • Cache eviction forces the actual memory accesses that are needed.
  • JavaScript can trigger precise microarchitectural effects despite its sandbox.
  • Through memory layout and repetition, a random bit flip becomes a building block for an exploit.
  • Hardware assumptions sit invisibly beneath operating system and browser isolation.
  • Side channels and fault attacks exploit shared, observable microarchitecture.

Insights

  • Software isolation inherits all the unspoken reliability assumptions of the hardware.
  • Remote code does not need privileges to influence physical states in a targeted way.

Quotes

  • Root privileges for web apps? – title of the talk

Habits

  • Maurice and Gruss reduce the attack to measurable memory and cache operations.

Facts

  • Clémentine Maurice and Daniel Gruss gave the talk together.

References

Critique

  • Exploitability depends heavily on DRAM, platform, browser and countermeasures.
  • The title states the maximum consequence in a pointed way, not the effect of every bit flip.

Remarks

  • The talk turned what seemed to be a reliability issue into a browser-side security problem.
  • Later Rowhammer variants bypassed several of the protections introduced at first.

Recommendations

  • Include known hardware faults in sandbox threat models.
  • Update firmware, browsers and kernels against known Rowhammer techniques.
  • Use ECC as an additional error control, not as the only defence.

Watch the talk

Search the Web Archive

CCC · 2010

PS3 Epic Fail: When a chain of trust loses its keys

bushing, marcan and sven take console security apart and show how implementation errors made custom code possible on hardware that was supposedly fully controlled. The three of them gave the talk together. The focus is on the break of PlayStation 3 security at the time.

hanez.org · 2023

Passkey gets a touch-sensitive trigger

Johannes replaces the previous push button of his Passkey project with a touch surface and plans a final enclosure. The project repository was renamed from passkey to Passkey. The new button works by touch.

Own project · 2016

USB Killer vs. IBM T22: 1:0 to the stick

In October 2016 I plugged a USB Killer into a retired but still working IBM ThinkPad T22, and afterwards it was dead. This post explains how the small device takes the energy for its attack from the victim’s USB port and why almost any hardware loses. It also answers the question why you would not simply use 230 volts, and shows what this means for protecting your own devices.