RAMBleed - New Side-Channel Attack

[biffzinker]

RAMBleed is a side-channel attack that enables an attacker to read out physical memory belonging to other processes. The implications of violating arbitrary privilege boundaries are numerous, and vary in severity based on the other software running on the target machine. As an example, in our paper we demonstrate an attack against OpenSSH in which we use RAMBleed to leak a 2048 bit RSA key. However, RAMBleed can be used for reading other data as well.

RAMBleed is based on a previous side channel called Rowhammer, which enables an attacker to flip bits in the memory space of other processes. We show in our paper that an attacker, by observing Rowhammer-induced bit flips in her own memory, can deduce the values in nearby DRAM rows. Thus, RAMBleed shifts Rowhammer from being a threat not only to integrity, but confidentiality as well. Furthermore, unlike Rowhammer, RAMBleed does not require persistent bit flips, and is thus effective against ECC memory commonly used by server computers.

How can I mitigate this issue?
Users can mitigate their risk by upgrading their memory to DDR4 with targeted row refresh (TRR) enabled.

CVE - CVE-2019-0174

Source: https://rambleed.com/

 

[R-T-B]

So basically a nonissue to anything but extremely high value targets, ala rowhammer

 

[metalfiber]

The white hat hackers is way more of a threat than the black hat hackers ever thought about being. The black hats have gotten more ideas on how to from the white hats.

 

[R-T-B]

The white hat hackers is way more of a threat than the black hat hackers ever thought about being. The black hats have gotten more ideas on how to from the white hats.

Trust me, the black hats likely knew about some of these and just told no one. Wrong philosophy.

 

[metalfiber]

Trust me, the black hats likely knew about some of these and just told no one. Wrong philosophy.

Yeah i know...i was just spitball'n. I mean we're putting everything into building our computers and we are slowly getting it cut down to where nothing but a nub is left.