{"id":102301,"date":"2021-11-16T21:36:47","date_gmt":"2021-11-16T19:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4"},"modified":"2021-11-16T21:36:47","modified_gmt":"2021-11-16T19:36:47","slug":"blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","title":{"rendered":"Blacksmith \u2014 o nou\u0103 atac asupra memoriei DRAM \u0219i cipurile DDR4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Un grup de cercet\u0103tori de la \u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne, Universitatea Liber\u0103 din Amsterdam \u0219i Qualcomm au publicat o nou\u0103 metod\u0103 de atac din clasa RowHammer, care permite modificarea con\u021binutului unor bi\u021bi individuali din memoria RAM dinamic\u0103 (DRAM). Atacul a fost numit Blacksmith \u0219i identificat cu CVE-2021-42114. Multe cipuri DDR4, dotate cu protec\u021bie \u00eempotriva metodelor anterioare din clasa RowHammer, sunt vulnerabile la aceast\u0103 problem\u0103. Instrumentele pentru testarea sistemelor proprii \u00eempotriva acestei vulnerabilit\u0103\u021bi sunt disponibile pe GitHub. <\/p>\n

Trebuie s\u0103 reamintim c\u0103 atacurile din clasa RowHammer permit distorsionarea con\u021binutului unor bi\u021bi de memorie prin citirea ciclic\u0103 a datelor din celule adiacente. Deoarece memoria DRAM reprezint\u0103 un aranjament bidimensional de celule, fiecare dintre acestea const\u00e2nd dintr-un condensator \u0219i un tranzistor, citirea continu\u0103 a acelea\u0219i zone de memorie duce la fluctua\u021bii de tensiune \u0219i anomalii care provoac\u0103 o pierdere minor\u0103 de sarcin\u0103 \u00een celulele vecine. Dac\u0103 intensitatea citirii este mare, celula vecin\u0103 poate pierde o cantitate semnificativ\u0103 de sarcin\u0103, iar urm\u0103torul ciclu de regenerare nu are timp s\u0103-i restituie starea ini\u021bial\u0103, ceea ce duce la modificarea valorii stocate \u00een celul\u0103. <\/p>\n

Pentru protejarea \u00eempotriva RowHammer, produc\u0103torii de cipuri au propus un mecanism TRR (Target Row Refresh), care ap\u0103r\u0103 de distorsiunile celulelor din r\u00e2ndurile adiacente. Totu\u0219i, deoarece aceast\u0103 protec\u021bie se baza pe principiul \u201esecuritate prin obscuritate\u201d, ea nu rezolva problema de fond \u0219i proteja doar \u00eempotriva cazurilor specifice cunoscute, ceea ce permitea g\u0103sirea u\u0219oar\u0103 a c\u0103ilor de ocolire a protec\u021biei. De exemplu, \u00een mai, compania Google a propus metoda Half-Double, care nu era afectat\u0103 de protec\u021bia TRR, deoarece atacul viza celulele care nu sunt direct adiacente la \u021bint\u0103. <\/p>\n

Noua metod\u0103 Blacksmith ofer\u0103 o alt\u0103 modalitate de a ocoli protec\u021bia TRR, bazat\u0103 pe adresarea inegal\u0103 a dou\u0103 sau mai multe r\u00e2nduri-agresor cu o frecven\u021b\u0103 diferit\u0103 pentru a provoca scurgeri de sarcin\u0103. Pentru a determina un model de acces la memorie care duce la scurgeri de sarcin\u0103, a fost dezvoltat un fuzzer special, care ajusteaz\u0103 automat parametrii atacului pentru cipul specific, variind ordinea, intensitatea \u0219i sistematicitatea accesului la celule. <\/p>\n

O astfel de abordare, nesus\u021binut\u0103 de afectarea acelora\u0219i celule, face ineficiente metodele actuale de protec\u021bie TRR, care se reduc, \u00eentr-un fel sau altul, la num\u0103rarea apelurilor repetate c\u0103tre celule \u0219i la ini\u021bierea reprog\u0103rii celulelor adiacente atunci c\u00e2nd se ating anumite valori. \u00cen Blacksmith, modelul de acces se extinde simultan pe mai multe celule din diferite p\u0103r\u021bi ale celei \u021bintite, ceea ce permite scurgerea de sarcin\u0103 f\u0103r\u0103 a atinge valorile prag. <\/p>\n

Metoda s-a dovedit a fi semnificativ mai eficient\u0103 dec\u00e2t metodele anterioare de ocolire a TRR \u2014 cercet\u0103torii au reu\u0219it s\u0103 provoace distorsiuni ale bi\u021bilor \u00een toate cele 40 de cipuri de memorie DDR4 recent achizi\u021bionate de la Samsung, Micron, SK Hynix \u0219i un produc\u0103tor necunoscut (pe 4 cipuri numele produc\u0103torului nu a fost specificat). Spre compara\u021bie, metoda TRRespass propus\u0103 anterior de aceia\u0219i cercet\u0103tori a fost eficient\u0103 doar pentru 13 din cele 42 de cipuri testate la acel moment. <\/p>\n

\u00cen general, se presupune c\u0103 metoda Blacksmith este aplicabil\u0103 pentru 94% din toate cipurile DRAM disponibile pe pia\u021b\u0103, dar conform declara\u021biilor cercet\u0103torilor, unele cipuri sunt mai vulnerabile \u0219i mai u\u0219or de atacat dec\u00e2t altele. Utilizarea codurilor de corec\u021bie a erorilor (ECC) \u00een cipuri \u0219i dublarea frecven\u021bei de actualizare a memoriei nu ofer\u0103 o protec\u021bie complet\u0103, dar complic\u0103 exploatarea. Este demn de remarcat c\u0103 problema nu poate fi blocat\u0103 \u00een cipurile deja lansate \u0219i necesit\u0103 implementarea unei noi protec\u021bii la nivel hardware, astfel \u00eenc\u00e2t atacul va r\u0103m\u00e2ne relevant \u00eenc\u0103 mul\u021bi ani. <\/p>\n

Ca exemple practice, sunt prezentate metodele de aplicare a Blacksmith pentru modificarea con\u021binutului \u00eenregistr\u0103rilor din tabelul paginilor de memorie (PTE, page table entry) pentru ob\u021binerea privilegii de nucleu, deteriorarea cheii publice RSA-2048 stocate \u00een memorie \u00een OpenSSH (se poate aduce cheia public\u0103 \u00een conformitate cu cheia privat\u0103 a atacatorului pentru conectarea la VM-ul victimei) \u0219i ocolirea verific\u0103rii \u00eemputernicirilor prin modificarea memoriei procesului sudo pentru ob\u021binerea privilegiilor root. \u00cen func\u021bie de cip, pentru modificarea unui singur bit \u021bint\u0103 este nevoie de la 3 secunde p\u00e2n\u0103 la c\u00e2teva ore de desf\u0103\u0219urare a atacului. ma\u0219ina virtual\u0103<\/a> de \u00eenregistrare a conexiunii la VM-ul victimei) \u0219i ocolirea verific\u0103rii \u00eemputernicirilor prin modificarea memoriei procesului sudo pentru ob\u021binerea privilegiilor root. \u00cen func\u021bie de cip, pentru modificarea unui singur bit \u021bint\u0103 este nevoie de la 3 secunde p\u00e2n\u0103 la c\u00e2teva ore de desf\u0103\u0219urare a atacului.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Pe l\u00e2ng\u0103 aceasta, se remarc\u0103 publicarea unui cadru deschis LiteX Row Hammer Tester pentru testarea metodologiilor de protec\u021bie a memoriei \u00eempotriva atacurilor de tip RowHammer, dezvoltat de compania Antmicro la cererea Google. Cadru se bazeaz\u0103 pe utilizarea FPGA pentru a controla complet comenzile transmise direct \u00een cipul DRAM, pentru a exclude influen\u021ba controlerului de memorie. Pentru interac\u021biunea cu FPGA, se propune un instrumentar \u00een limbajul Python. Gateway-ul bazat pe FPGA include un modul pentru transferul de date \u00een loturi (care define\u0219te tiparele de acces la memorie), Payload Executor, un controler bazat pe LiteDRAM (care prelucreaz\u0103 toat\u0103 logica necesar\u0103 pentru DRAM, inclusiv activarea r\u00e2ndurilor \u0219i actualizarea memoriei) \u0219i CPU VexRiscv. Lucr\u0103rile proiectului sunt distribuite sub licen\u021ba Apache 2.0. Este suportat\u0103 utilizarea diferitelor platforme FPGA, inclusiv Lattice ECP5, Xilinx Series 6, 7, UltraScale \u0219i UltraScale+.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0410\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blacksmith \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2021-42114. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0433\u0438\u0435 \u0447\u0438\u043f\u044b DDR4, \u0441\u043d\u0430\u0431\u0436\u0451\u043d\u043d\u044b\u0435 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102301","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Blacksmith \u2014 un nou atac asupra memoriei DRAM \u0219i cipurilor DDR4 | ProHoster","description":"Un grup de cercet\u0103tori de la ETH Zurich, Universitatea Liber\u0103 din Amsterdam \u0219i Qualcomm a publicat o nou\u0103 metod\u0103 de atac RowHammer, care permite modificarea con\u021binutului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Blacksmith \u2014 \u043d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c DRAM \u0438 \u0447\u0438\u043f\u044b DDR4 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:47+00:00","article:modified_time":"2021-11-16T19:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102301","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:42","updated":"2022-10-05 17:04:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102301"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102301\/revisions"}],"predecessor-version":[{"id":164192,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102301\/revisions\/164192"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}