{"id":102301,"date":"2021-11-16T21:36:47","date_gmt":"2021-11-16T19:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4"},"modified":"2021-11-16T21:36:47","modified_gmt":"2021-11-16T19:36:47","slug":"blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","title":{"rendered":"Blacksmith \u2014 et nyt angreb p\u00e5 DRAM-hukommelse og DDR4-chips","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En gruppe forskere fra ETH Z\u00fcrich, Vrije Universiteit Amsterdam og Qualcomm har offentliggjort en ny metode for RowHammer-angreb, der g\u00f8r det muligt at \u00e6ndre indholdet af individuelle bits i dynamisk RAM (DRAM). Angrebet er tildelt kode-navnet Blacksmith og CVE-2021-42114. Mange DDR4-chips, der er sikret mod tidligere kendte RowHammer-metoder, er s\u00e5rbare over for dette problem. Et v\u00e6rkt\u00f8j til at teste ens systemer for s\u00e5rbarhed er offentliggjort p\u00e5 GitHub. <\/p>\n

Husk, at RowHammer-angreb tillader forvr\u00e6ngning af indholdet af individuelle bits i hukommelsen ved at l\u00e6se data cyklisk fra n\u00e6rliggende hukommelsesceller. Da DRAM-hukommelsen er et todimensionelt array af celler, hvor hver celle best\u00e5r af en kondensator og en transistor, vil vedvarende l\u00e6sning af det samme hukommelsesomr\u00e5de medf\u00f8re sp\u00e6ndingsfluktuationer og anomalier, der for\u00e5rsager et lille ladetab i nabocellerne. Hvis l\u00e6seintensiteten er h\u00f8j, kan nabocellen miste en betydelig m\u00e6ngde ladning, s\u00e5 den n\u00e6ste regenerationscyklus ikke kan gendanne dens oprindelige tilstand, hvilket f\u00f8rer til \u00e6ndringen af de gemte data i cellen. <\/p>\n

For protection against RowHammer, chip manufacturers proposed the TRR (Target Row Refresh) mechanism, which protects against cell distortion in adjacent rows. However, since the protection was based on the principle of 'security through obscurity,' it did not address the problem fundamentally and only protected against known edge cases, making it easy to find ways to bypass the protection. For example, in May, Google suggested the Half-Double method, which was unaffected by TRR protection, as the attack involved cells not directly adjacent to the target. <\/p>\n

Den nye Blacksmith-metode tilbyder en anden m\u00e5de at omg\u00e5 TRR-beskyttelsen p\u00e5, baseret p\u00e5 heterogen adgang med forskellig frekvens til to eller flere aggressor-str\u00e6k for at for\u00e5rsage ladetab. For at bestemme det hukommelsesm\u00f8nster, der f\u00f8rer til ladetab, er der udviklet en s\u00e6rlig fuzzer, der automatisk justerer angrebsparametre for den specifikke chip ved at variere r\u00e6kkef\u00f8lgen, intensiteten og systematikken af adgangen til cellerne. <\/p>\n

En s\u00e5dan tilgang, der ikke er relateret til p\u00e5virkning af de samme celler, g\u00f8r de nuv\u00e6rende TRR-beskyttelsesmetoder ineffektive, idet de i en eller anden form reduceres til at t\u00e6lle antallet af gentagne adgang til celler og ved opn\u00e5else af bestemte v\u00e6rdier initiere en genopladning af n\u00e6rliggende celler. I Blacksmith-m\u00f8nsteret spredes adgangsm\u00f8nsteret straks over flere celler fra forskellige sider af den m\u00e5lrettede, hvilket muligg\u00f8r ladningsl\u00e6kage uden at n\u00e5 t\u00e6rskelv\u00e6rdierne. <\/p>\n

The method proved to be significantly more effective than previously suggested bypass methods. Researchers managed to achieve bit distortion in all 40 recently purchased different DDR4 memory chips from Samsung, Micron, SK Hynix, and an unknown manufacturer (the manufacturer was not specified on 4 chips). In comparison, the previously proposed method by the same researchers, TRRespass, was only effective for 13 out of the 42 chips tested at that time. <\/p>\n

Generelt antages det, at Blacksmith-metoden er anvendelig p\u00e5 94 % af alle DRAM-chips, der findes p\u00e5 markedet, men if\u00f8lge forskerne er nogle chips mere s\u00e5rbare og lettere at angribe end andre. Brug af fejlkorrigerende koder (ECC) i chipperne og fordobling af hukommelsesopdateringsfrekvensen sikrer ikke fuld beskyttelse, men komplicerer udnyttelsen. Bem\u00e6rkelsesv\u00e6rdigt er, at problemet ikke kan blokeres i allerede udgivne chips og kr\u00e6ver implementering af ny beskyttelse p\u00e5 hardwareniveau, hvilket g\u00f8r angrebet relevant i mange \u00e5r fremover. <\/p>\n

Som praktiske eksempler pr\u00e6senteres metoder til anvendelse af Blacksmith til at \u00e6ndre indholdet af optegnelser i hukommelsens side-tabel (PTE, page table entry) for at opn\u00e5 kernetilladelser, beskadige den gemte RSA-2048 offentlige n\u00f8gle i OpenSSH (den offentlige n\u00f8gle kan bruges til at matche den private n\u00f8gle til angriberen for at forbinde til offerets VM) og omg\u00e5else af kompetencekontrol ved at \u00e6ndre hukommelsen i sudo-processen for at opn\u00e5 root-rettigheder. Afh\u00e6ngigt af chippen kr\u00e6ver det mellem 3 sekunder til flere timer at \u00e6ndre et enkelt m\u00e5lbit. virtuelle maskiner<\/a> I tilf\u00e6lde af chippen kr\u00e6ver det mellem 3 sekunder og flere timer at udf\u00f8re angrebet for at \u00e6ndre en enkelt m\u00e5lbit.

\r\n \"Afspil\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Der skal ogs\u00e5 n\u00e6vnes offentligg\u00f8relsen af det \u00e5bne rammev\u00e6rk LiteX Row Hammer Tester, der bruges til at teste beskyttelsesmetoder mod RowHammer-angreb, udviklet af virksomheden Antmicro p\u00e5 vegne af Google. Rammev\u00e6rket er baseret p\u00e5 brugen af FPGA for fuldst\u00e6ndig kontrol over de kommandoer, der sendes direkte til DRAM-chippen for at udelukke indflydelsen fra hukommelseskontrolleren. Til interaktion med FPGA tilbydes v\u00e6rkt\u00f8jer p\u00e5 Python-sprog. FPGA-baseret gateway inkluderer en modul til batchdataoverf\u00f8rsel (definerer hukommelsesm\u00f8nstre), Payload Executor, en controller baseret p\u00e5 LiteDRAM (som h\u00e5ndterer al n\u00f8dvendig logik for DRAM, inklusive aktivering af r\u00e6kker og opdatering af hukommelse) og CPU VexRiscv. Projektets fremskridt distribueres under Apache 2.0-licensen. Der underst\u00f8ttes brug af forskellige FPGA-platforme, inklusive Lattice ECP5, Xilinx Series 6, 7, UltraScale og UltraScale+.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0410\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blacksmith \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2021-42114. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0433\u0438\u0435 \u0447\u0438\u043f\u044b DDR4, \u0441\u043d\u0430\u0431\u0436\u0451\u043d\u043d\u044b\u0435 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102301","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Blacksmith \u2014 et nyt angreb p\u00e5 DRAM-hukommelse og DDR4-chips | ProHoster","description":"En gruppe forskere fra ETH Z\u00fcrich, Vrije Universiteit Amsterdam og Qualcomm har offentliggjort en ny metode til RowHammer-angreb, der muligg\u00f8r \u00e6ndring af indholdet.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Blacksmith \u2014 \u043d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c DRAM \u0438 \u0447\u0438\u043f\u044b DDR4 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:47+00:00","article:modified_time":"2021-11-16T19:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102301","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:42","updated":"2022-10-05 17:04:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=102301"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102301\/revisions"}],"predecessor-version":[{"id":164192,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102301\/revisions\/164192"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=102301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=102301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=102301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}