{"id":102301,"date":"2021-11-16T21:36:47","date_gmt":"2021-11-16T19:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4"},"modified":"2021-11-16T21:36:47","modified_gmt":"2021-11-16T19:36:47","slug":"blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","title":{"rendered":"Blacksmith \u2014 um novo ataque \u00e0 mem\u00f3ria DRAM e chips DDR4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um grupo de pesquisadores da Escola Polit\u00e9cnica Federal de Zurique, da Universidade Livre de Amsterd\u00e3 e da Qualcomm publicou um novo m\u00e9todo de ataque da classe RowHammer, permitindo modificar o conte\u00fado de bits individuais da mem\u00f3ria din\u00e2mica (DRAM). O ataque recebeu o nome de c\u00f3digo Blacksmith e a identifica\u00e7\u00e3o CVE-2021-42114. Muitos chips DDR4 que possuem prote\u00e7\u00e3o contra m\u00e9todos anteriormente conhecidos da classe RowHammer s\u00e3o vulner\u00e1veis. A ferramenta para testar seus sistemas quanto \u00e0 vulnerabilidade foi publicada no GitHub. <\/p>\n

Vale lembrar que ataques da classe RowHammer permitem distorcer o conte\u00fado de bits individuais da mem\u00f3ria atrav\u00e9s da leitura c\u00edclica de dados em c\u00e9lulas de mem\u00f3ria adjacentes. Como a mem\u00f3ria DRAM \u00e9 um array bidimensional de c\u00e9lulas, cada uma composta por um capacitor e um transistor, a execu\u00e7\u00e3o cont\u00ednua da leitura de uma mesma \u00e1rea da mem\u00f3ria leva a flutua\u00e7\u00f5es de tens\u00e3o e anomalias, causando uma pequena perda de carga em c\u00e9lulas adjacentes. Se a intensidade de leitura for alta, a c\u00e9lula adjacente pode perder uma quantidade significativa de carga, e o ciclo de regenera\u00e7\u00e3o subsequente n\u00e3o ser\u00e1 r\u00e1pido o suficiente para restaurar seu estado original, resultando na altera\u00e7\u00e3o do valor dos dados armazenados na c\u00e9lula. <\/p>\n

Para proteger contra o RowHammer, os fabricantes de chips propuseram o mecanismo TRR (Target Row Refresh), que protege contra a corrup\u00e7\u00e3o de c\u00e9lulas nas linhas adjacentes. No entanto, como a prote\u00e7\u00e3o se baseava no princ\u00edpio de \"seguran\u00e7a pela obscuridade\", ela n\u00e3o resolvia o problema fundamental, protegendo apenas contra casos conhecidos, o que permitia encontrar facilmente maneiras de contornar a prote\u00e7\u00e3o. Por exemplo, em maio, a Google apresentou o m\u00e9todo Half-Double, que n\u00e3o era afetado pela prote\u00e7\u00e3o TRR, pois a ataque envolvia c\u00e9lulas n\u00e3o adjacentes \u00e0 c\u00e9lula alvo. <\/p>\n

O novo m\u00e9todo Blacksmith oferece uma maneira diferente de contornar a prote\u00e7\u00e3o TRR, baseada no tratamento heterog\u00eaneo com diferentes frequ\u00eancias de duas ou mais linhas agressoras para gerar vazamentos de carga. Para determinar o padr\u00e3o de acesso \u00e0 mem\u00f3ria que leva ao vazamento de carga, foi desenvolvido um fuzzer especial que ajusta automaticamente os par\u00e2metros do ataque para um chip espec\u00edfico, variando a ordem, intensidade e sistematicidade do acesso \u00e0s c\u00e9lulas. <\/p>\n

Uma abordagem semelhante, que n\u00e3o envolve a intera\u00e7\u00e3o com as mesmas c\u00e9lulas, torna ineficazes os m\u00e9todos atuais de prote\u00e7\u00e3o TRR, que, de uma forma ou de outra, se resumem \u00e0 contagem do n\u00famero de acessos repetidos \u00e0s c\u00e9lulas e, ao atingir determinados valores, \u00e0 inicializa\u00e7\u00e3o da recarga das c\u00e9lulas vizinhas. No Blacksmith, o padr\u00e3o de acesso \u00e9 espalhado instantaneamente por v\u00e1rias c\u00e9lulas de diferentes lados da c\u00e9lula alvo, permitindo a vazamento de carga sem atingir os limites de refer\u00eancia. <\/p>\n

O m\u00e9todo se mostrou significativamente mais eficaz do que os m\u00e9todos anteriormente propostos para contornar o TRR \u2014 os pesquisadores conseguiram corromper bits em todos os 40 diferentes chips de mem\u00f3ria DDR4 recentemente adquiridos de fabricantes como Samsung, Micron, SK Hynix e um fabricante desconhecido (em 4 chips, o fabricante n\u00e3o foi especificado). Em compara\u00e7\u00e3o, o m\u00e9todo TRRespass, proposto pelos mesmos pesquisadores, foi eficaz apenas para 13 dos 42 chips testados na \u00e9poca. <\/p>\n

De maneira geral, presume-se que o m\u00e9todo Blacksmith seja aplic\u00e1vel a 94% de todos os chips DRAM dispon\u00edveis no mercado, mas segundo os pesquisadores, alguns chips s\u00e3o mais vulner\u00e1veis e mais f\u00e1ceis de atacar do que outros. A utiliza\u00e7\u00e3o de c\u00f3digos de corre\u00e7\u00e3o de erros (ECC) nos chips e a duplica\u00e7\u00e3o da taxa de atualiza\u00e7\u00e3o da mem\u00f3ria n\u00e3o garantem prote\u00e7\u00e3o total, mas complicam a explora\u00e7\u00e3o. \u00c9 not\u00e1vel que o problema n\u00e3o pode ser bloqueado em chips j\u00e1 lan\u00e7ados e requer a implementa\u00e7\u00e3o de nova prote\u00e7\u00e3o a n\u00edvel de hardware, portanto, o ataque continuar\u00e1 sendo relevante por muitos anos. <\/p>\n

Como exemplos pr\u00e1ticos, foram apresentados m\u00e9todos de aplica\u00e7\u00e3o do Blacksmith para alterar o conte\u00fado das entradas de tabela de p\u00e1ginas de mem\u00f3ria (PTE, page table entry) para obter privil\u00e9gios de kernel, danificando a chave p\u00fablica RSA-2048 armazenada em mem\u00f3ria no OpenSSH (\u00e9 poss\u00edvel fornecer uma chave p\u00fablica correspondente \u00e0 chave privada do atacante para se conectar \u00e0 VM da v\u00edtima) e contornando a verifica\u00e7\u00e3o de privil\u00e9gios atrav\u00e9s da modifica\u00e7\u00e3o da mem\u00f3ria do processo sudo para obter acesso root. Dependendo do chip, alterar um \u00fanico bit alvo requer de 3 segundos a v\u00e1rias horas de ataque. m\u00e1quina virtual<\/a> O exemplo mencionado acima ilustra como um \u00fanico bit pode ser comprometido usando o m\u00e9todo Blacksmith, conforme descrito detalhadamente pelos pesquisadores.

\r\n \"Por\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Adicionalmente, pode-se mencionar a publica\u00e7\u00e3o do framework aberto LiteX Row Hammer Tester para testar os m\u00e9todos de prote\u00e7\u00e3o da mem\u00f3ria contra ataques do tipo RowHammer, desenvolvido pela Antmicro a pedido do Google. O framework \u00e9 baseado no uso de FPGA para controle total dos comandos enviados diretamente ao chip DRAM, eliminando a influ\u00eancia do controlador de mem\u00f3ria. Para interagir com a FPGA, oferece-se uma ferramenta em Python. O gateway FPGA inclui um m\u00f3dulo para transmiss\u00e3o de dados em lote (que define padr\u00f5es de acesso \u00e0 mem\u00f3ria), Payload Executor, um controlador baseado em LiteDRAM (que processa toda a l\u00f3gica necess\u00e1ria para a DRAM, incluindo a ativa\u00e7\u00e3o de linhas e atualiza\u00e7\u00e3o de mem\u00f3ria) e a CPU VexRiscv. Os desenvolvimentos do projeto s\u00e3o disponibilizados sob a licen\u00e7a Apache 2.0. \u00c9 suportado o uso de v\u00e1rias plataformas FPGA, incluindo Lattice ECP5, Xilinx Series 6, 7, UltraScale e UltraScale+.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0410\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blacksmith \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2021-42114. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0433\u0438\u0435 \u0447\u0438\u043f\u044b DDR4, \u0441\u043d\u0430\u0431\u0436\u0451\u043d\u043d\u044b\u0435 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102301","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Blacksmith \u2014 novo ataque \u00e0 mem\u00f3ria DRAM e chips DDR4 | ProHoster","description":"Um grupo de pesquisadores da Escola Polit\u00e9cnica Federal de Zurique, da Universidade Livre de Amsterd\u00e3 e da Qualcomm publicou um novo m\u00e9todo de ataque do tipo RowHammer, que permite alterar o conte\u00fado.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Blacksmith \u2014 \u043d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c DRAM \u0438 \u0447\u0438\u043f\u044b DDR4 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:47+00:00","article:modified_time":"2021-11-16T19:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102301","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:42","updated":"2022-10-05 17:04:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=102301"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102301\/revisions"}],"predecessor-version":[{"id":164192,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102301\/revisions\/164192"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=102301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=102301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=102301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}