DRAMA: How Your DRAM Becomes a Security Problem

Presented at Black Hat Europe 2016, Nov. 4, 2016, 2 p.m. (60 minutes).

In this talk, we will present our research into how the design of DRAM common to all computers and many other devices makes these computers and devices insecure. Since our attack methodology targets the DRAM, it is mostly independent of software flaws, operating system, virtualization technology and even CPU. The attack is based on the presence of a row buffer in all DRAM modules. While this buffer is of vital importance to the way DRAM works physically, they also provide an attack surface for a side channel attack. These side channel attacks allow an unprivileged user to gain knowledge and spy on anybody sharing the same system even when located on a different CPU or running in a different Virtual Machine. We will show that we can exploit this side channel even in the limited environment of a sandboxed JavaScript application despite the countermeasures implemented in modern browsers.

We will demonstrate the attack by sending data from a virtual machine without network hardware to the internet via the DRAM row buffer. The JavaScript library to exploit this attack vector will be made open source. Further these attacks enabled us to reverse engineer the complex addressing function of the CPU. This knowledge has real world implication for other software attacks on hardware, such as the row hammer attack. We will discuss how our finding led to moving the row hammer attack to DDR4 ram and how this research enabled other researchers to do software based fault injection attacks on cryptographic keys. We present an easy-to-use tool that can reverse engineer the CPUs addressing function fully automated. This tool is open source and can be used to reproduce the presented attacks, improve existing rowhammer-based attacks and to find new attacks.


Presenters:

  • Anders Fogh - Principal Malware Analyst, G DATA Advanced Analytics
    Anders Fogh is Principal malware analyst at G DATA Advanced analytics. He has led numerous low level engineering efforts in the past 11 years. Prior to that he co-founded Protect Software GmbG where he was responsible for major developments in video and CD/DVD recording software. Since 1993 he has been an avid malware hobbyist and has reverse engineering experience with operating systems from DOS to present day OSs as well as devices ranging from DVD players to USB sticks. He holds a master's degree in economics from the University of Aarhus. He was the first to suggest a software solution to the row hammer bug and spoke at Black Hat 2015 and 2016 as well as Hack In The Box.
  • Michael Schwarz - Student, Graz University of Technology
    Michael Schwarz is an infosec Ph.D. student at Graz University of Technology. He holds two master's degrees, one in computer science and one in software development with a strong focus on security. He frequently participates in CTFs and has also been a finalist in the European Cyber Security Challenge. He has co-authored several papers published at academic conferences and journals, including USENIX Security 2016.

Links:

Similar Presentations: