Back to threat feeds
Rowhammer
Rowhammer Fuzzer dubbed Blacksmith bypasses DRAM defenses
A new fuzzing technique Blacksmith exploits Rowhammer vulnerability in DRAM devices while bypassing existing TRR mitigation methods...
Continue reading
A new fuzzing technique Blacksmith exploits Rowhammer vulnerability in DRAM devices while bypassing existing TRR mitigation methods...
Continue reading
A research paper **published** on Monday by Comsec demonstrated a technique named 'Blacksmith' that triggers Rowhammer bit flips on DRAM devices. Leaked charges in DRAM cells enable attackers to flip bits in the memory, causing the Rowhammer vulnerability. It bypasses a traditional mitigation method, known as Target Row Refresh(TRR).
This vulnerability has been around since 2012; it was first observed when commodity DRAM chips suffered disturbance due to repeated opening and closing of a DRAM row. It caused neighboring rows to leak charge continuously to a point where they no longer can retain. Consequently, it resulted in bit flips that had a significant impact on security systems. This vulnerability can be exploited to compromise users through Javascript, cloud, mobile phones, and over the network.
_Rowhammer access points_
A standard Rowhammer attack consists of three phases:
Blacksmith takes effect during the first phase where an attacker tries to find a pattern that triggers a bit flip.
The parameters frequency, phase, and amplitude were used to design frequency-based Rowhammer patterns to explore the space of non-uniform patterns. The resulting patterns were implemented in a black-box fuzzer that crafted patterns for specific devices.
Researchers demonstrated an attack with 40 DDR4 devices from Samsung, Micron, and SK Hynix manufacturers. After the Blacksmith fuzzer ran for 12 hours, it triggered large bit flips in all 40 DRAM devices.
_Blacksmith Execution_
They further conducted attacks that indicated real-world exploitations, which allowed them to redirect page frames to an attacker-controlled page. An attacker retrieved private keys of RSA-2048 that authenticated an SSH host; for the third attack, they demonstrated privilege escalation to gain root access in the password verification logic.
Researchers concluded, _"Our work confirms that the DRAM vendors’ claims about Rowhammer protections are false and lure you into a false sense of security. All currently deployed mitigations are insufficient to protect against Rowhammer fully. Our novel patterns show that attackers can more easily exploit systems than previously assumed."_
Hugging Face did not know at the time of its own disclosure who or what was behind the intrusion
