Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security

Using Memory Errors to Attack a Virtual Machine 251

Posted by michael from the no-one-is-safe dept.
gillus writes "A very cool scientific paper from Appel and Govindavajhala that explains how virtual machines like java or .Net can be exploited. How? Quite simple, bomb your DRAM chip with X-rays... or more simply with 50-watt spotlight, as the authors demonstrate. Definitively worth a read!"
This discussion has been archived. No new comments can be posted.

Using Memory Errors to Attack a Virtual Machine More

Using Memory Errors to Attack a Virtual Machine

Comments Filter:

  • This just in! (Score:4, Funny)

    by G-funk ( 22712 ) <josh@gfunk007.com> on Saturday March 15, 2003 @04:10AM (#5518292) Homepage Journal
    Reports are sketchy at present, but we're being led to believe that it's easy to compromise a machine to which you have physical access!

    Film at 11.

    • Re:This just in! (Score:5, Informative)

      by smallpaul ( 65919 ) <paul @ p r e s c o d . net> on Saturday March 15, 2003 @04:20AM (#5518317)

      Reports are sketchy at present, but we're being led to believe that it's easy to compromise a machine to which you have physical access!

      Bet you didn't even read the abstract. Here's the relevant bit:

      Our attack is particularly relevant against smart cards or tamper-resistant computers, where the user has physical access (to the outside of the computer) and can use various means to induce faults; we have successfully used heat.

      • Re:This just in! (Score:3, Insightful)

        by Com2Kid ( 142006 )
        • Our attack is particularly relevant against smart cards or tamper-resistant computers, where the user has physical access (to the outside of the computer) and can use various means to induce faults; we have successfully used heat.

        If somebody intent on breaking through the smart card's security has access to the smart card, then sooner or later the security WILL be broken. Encrypting data is NOT a foolproof way to keep things safe, though having the security measures last a dozen or so years IS a rather s

        • Re:This just in! (Score:5, Informative)

          by arvindn ( 542080 ) on Saturday March 15, 2003 @06:06AM (#5518542) Homepage Journal
          If somebody intent on breaking through the smart card's security has access to the smart card, then sooner or later the security WILL be broken.
          Get a clue. The whole point of a smart card is to keep the data safe even in the event of physical tampering. For this purpose, the processor of a smart card is enclosed in a black box which will chemically self-destruct if you try to tamper with it. Much research on smart cards goes into ensuring that security can not be broken in spite of physical access.

          Some pointers:

          • Re:This just in! (Score:3, Interesting)

            by Com2Kid ( 142006 )
            • Get a clue. The whole point of a smart card is to keep the data safe even in the event of physical tampering. For this purpose, the processor of a smart card is enclosed in a black box which will chemically self-destruct if you try to tamper with it. Much research on smart cards goes into ensuring that security can not be broken in spite of physical access.

            Sorry, I am used to seeing regular static memory chips marketed as being "smart cards", I did not realize that there was an actual secure version of t

            • Brute force (Score:5, Insightful)

              by Xner ( 96363 ) on Saturday March 15, 2003 @11:13AM (#5519233) Homepage
              Any encryption can still be broken through though brute force.

              And any literary work can be obtained with an infinite number of monkeys sitting at an infinite number of typewriters for an infinitely long period of time.

              Most serious ciphers attacked using brute force with contemporary technology will probably hold out until the universe's heat death. Not to mention the fact that some experts claim that there simply is not enough energy in the universe to cycle a 128 bit counter through all its states, let alone perform any computations.

              • Re:Brute force (Score:2, Informative)

                by Anonymous Coward
                Actually, Schneier points out that if you built a Dyson sphere around the sun to trap all its energy, it MIGHT be enough to cycle a counter through all (2**128) states before it implodes, if your high and low voltages were just barely distinguishable and you can do it fast enough.

                Not that it's terribly useful. A 256-bit key would require that you perform the same feat (2**128) times-- which I doubt will happen.
              • You don't need an infinite amount of time. One of your infinite monkeys will produce any work in the ammount of time it takes to bang on the keys of its typewriter.

                Also one monkey at one typewriter given an infinite amount of time will also produce all literary works.

                Quantum computers are somewhat like the first example, where today's technology is basicly like the second.

            • Re:This just in! (Score:5, Insightful)

              by omnirealm ( 244599 ) on Saturday March 15, 2003 @12:05PM (#5519451) Homepage

              Any encryption can still be broken through though brute force.

              This is simply not true. One-time pads are 100% unbreakable, and they will always be unbreakable (at least mathematically speaking), no matter how sophisticated technology gets in the future. For those who are unfamiliar with the concept, a one-time pad is a cryptographically random string of 1's and 0's, which is at least of the same length of the message itself. Two parties have a secure channel in which to exchange these pads; for example, if Alice and Bob wish to use one-time pads, Alice can generate a list of 10,000 cryptographically random strings, put them in a suitcase that is handcuffed to her wrist, and deliver them to Bob in person. Bob and Alice then have a set of one-time pads that they can use for all future communication. Each time they encrypt a message with one of the pads, they discard the pad and never use it again. Because the pad is at least the length of any messages they might pass back and forth, there is no way to analyze the encrypted message for patterns. It is mathematically impossible. You could easily come up strings of 1's and 0's that would ``decrypt'' the message into anything, be it passages from the Bible, or Ogg Vorbis encoded music. You would have no idea which set of 1's and 0's produced the actual original message. This is truly unbreakable encryption on a mathematical level.

              Most companies claiming that their encryption is ``unbreakable'' are using one-time pads; the problem is reduced to finding a secure channel of communications in which to transmit those pads. This is usually not a feasible assumption, which is why we all prefer using, for example, Diffie-Hellman key exchange, which depends on the difficulty of math involving discrete logarithms. The encryption we now use is breakable, but it is hard enough to break that it is generally considered secure.

              • The problem with the one-time pad is that it is completely impractical. Empirical evidence shows that it one-time pads are actually LESS secure than other encryption schemes. The pads are intercepted or copied when they are delivered from place to place or are reused because a message had to be sent but the new pads had not yet arrived. The mathematical perfection of a one-time pad is kinda nifty, but is about as useful as postulating a spherical cow in a mathematical study to improve dairy production.

              • Re:This just in! (Score:3, Interesting)

                by Chester K ( 145560 )
                Two parties have a secure channel in which to exchange these pads.

                OTP is mathematically 100% secure, but not practically.
                • The whole point of encryption is to make secure an otherwise unsecure channel of communication. If you have a secure channel in the first place (which you need to exchange pads with OTP), then why not just send the data you want to communicate through that channel and do away with encryption altogether?
                • Someone can intercept your pads and you'd never know. OTP is extremely vulnerable

              • Re:This just in! (Score:2, Insightful)

                by xiitone ( 152104 )
                >Most companies claiming that their encryption is >``unbreakable'' are using one-time pads;
                and most of these snake oil salesman are using algorithmic "random" number generation. There's two delicate parts of one time pads-distributing the pad , and your pad generation.

            • Re:This just in! (Score:5, Informative)

              by rjh ( 40933 ) <rjh@sixdemonbag.org> on Saturday March 15, 2003 @03:32PM (#5520328)
              Any encryption can still be broken through though brute force

              <sigh> You know, I answered just this same question yesterday... </sigh>

              As a thermodynamic minimum it takes 4.4 * 10**-26 joules to set a bit. (Well, it takes that much to erase one bit of information. But that's quibbling.) So multiply that by 256, for the number of bits in an AES key, and you get 1.1 * 10**-23 joules to store a key.

              Now multiply this by 2**255, which is the number of AES keys you'd have to try to break it by brute force (on average). You get 6.4 * 10**53 joules of energy needed.

              The total annual energy output of the Sun is on the order of 10**34 joules. Multiply that by 10**10 to compute the total energy release over the Sun's entire lifespan (yes, this is a nasty kludge of an estimate, I know the Sun's energy output varies) and you get 10**44 joules of energy.

              Which means you've only exhausted one billionth of the damn keyspace.

              No, you can't break any encryption through brute force. There just isn't enough energy in the universe to do it, even positing thermodynamically-perfect computers operating at 3.2K.
              • Well, at least you did not do the Power/ENergy thing this time :)

                Very cool argument though. I have never heard it before your previous posting. Just an interesting question: That number you used to indicate the minimum amount of energy to flip (or reset) a bit. Any references on that? I am not a big expert on Thermodynamics, but why is there a minimum energy involved?

                Oh, and since you seem to be the resident expert, what is your opinion on the security of AES, in particular of Rijndael in comparison to Bl

                • Re:This just in! (Score:3, Interesting)

                  by rjh ( 40933 )
                  at least you did not do the Power/ENergy thing this time

                  Make one little mistake, they never let you forget it. :)

                  Just an interesting question: That number you used to indicate the minimum amount of energy to flip (or reset) a bit. Any references on that?

                  Sure. The Boltzmann Constant, 1.38 * 10**-23 joules per Kelvin, is the fundamental relationship between temperature and energy. You can think of it as, "this is a quanta of energy at a given temperature". (It's not, and physics majors the world over

          • Re:This just in! (Score:4, Informative)

            by Large Green Mallard ( 31462 ) <lgm@theducks.org> on Saturday March 15, 2003 @08:15AM (#5518773) Homepage
            Smart Cards will protect themselves to some extent, but the oft quoted voltage draw analysys is something they can't protect against..

            What you really need for a physically secure device is an IBM 4758 CryptoCard.. [ibm.com] of course, for it to be useful, you need it protected against key recovery attacks. [slashdot.org]

            • Re:This just in! (Score:2, Interesting)

              by shepd ( 155729 )
              >What you really need for a physically secure device is an IBM 4758 CryptoCard.. of course, for it to be useful, you need it protected against key recovery attacks.

              That card still isn't invulnerable against being picked apart by electron scannining micrographs and other handy (expensive) physical analysis.

              You might consider this impractical, but this is exactly how certain digital TV services in Europe has competed, by hacking each other's cards at any expense.

              The only true way to have a secure system
            • Sure you can protect yourself from differential power analysis, or whatever it's called. You can design logic gates that draw the same power whatever. Or you can add extra logic that masks other activity. You can design algorithms that draw power in exactly the same power whatever the input, possibly performing unnecessary dummy steps. There are lots of defenses.
            • Yes; there is a defense against differential power analysis. You incorporate a capacitor into the card's interface into the power supply, thereby leveling the power drawn.
              • Capacitors take up space; it'd be much easier to design a power supply on the card which ALWAYS draws the same amount of power (slightly more than the maximum you'd expect the chip to use) and dumps any excess power into a 'dummy load'.

                This is similar to the concept of sending junk data over your encrypted channel when it's not in use, to foil traffic analysis.

      • Re:This just in! (Score:4, Interesting)

        by anubi ( 640541 ) on Saturday March 15, 2003 @05:11AM (#5518431) Journal
        "Our attack is particularly relevant against smart cards or tamper-resistant computers, where the user has physical access (to the outside of the computer) and can use various means to induce faults; we have successfully used heat."
        I would imagine that nasty EMI spikes you may couple to the inside of the box, or medical radioactive sources would work too.

        Just a guess, but I have sure had my share of EMI and radiation induced problems.

      • Re:This just in! (Score:4, Insightful)

        by mentin ( 202456 ) on Saturday March 15, 2003 @05:41AM (#5518488)
        Well, there are already many error-induction attacks agains smart cards (some references in the article), that don't involve JVM running untrusted code.

        So if I can break smart card event if is does not run any my [untrusted] code, who cares about attack to smart card that allows to run untrusted code? Besides, I've never seen any smartcard that actually does this stupid thing.

        A better target for attack may be a server at a nuclear reactor facility that has natural high rate of memory failures :)

        • Well, there are already many error-induction attacks agains smart cards (some references in the article), that don't involve JVM running untrusted code.

          Great. How do you take advantage of them? The published hack allows you to take over the security manager of the VM and become essentially "god" on the smartcard. So on the one hand you could induce an error on the card to invalidate the money on it (useless) or on the other hand you could induce an error that allows you to do anything you want, includi

          • Good for you. If they exist (they do) and they are being promoted/advertised (they are) then their security considerations are relevant.

            I would like to see a reference. I saw couple of smart cards that can be programmed in Java (AMEX Blue is one example), but Java is used there just for its portability and simplicity of programming. All Java code-based security features are not used at all (and probably not implemented). I have not heard of and can't imagine any useful application of a smart card that al

            • It would have only taken two minutes of research for you to find it [google.ca] yourself: There are several unique benefits of the Java Card technology, such as: Dynamic- New applications can be installed securely after a card has been issued, providing card issuers with the ability to dynamically respond to their customer's changing needs.

              That's how Sun is advertising Java Smart Cards. Personally, I'm glad somebody is investigating their claims.

    • Re:This just in! (Score:2, Insightful)

      by Anonymous Coward
      What this could lead to, if it works and ends up working well, is running other processes in a machine that do end up causing memory errors. far fetched? probably, but all exploits involve a range of small weaknesses (except Windows ones, as Windows is one large weakness).

      Take a look at core memory. Memory access there, when random, was fine. Go looking continually at one row of cores and bam - your wire heats up. Go continually looking at the one single core (read or write) and it was possible to effectiv
      • "One commodore 64 demo program (just a few POKE statements)..."

        You're not thinking of the Commodore PET "urban legend" are you?
        C64 != PET. PET != C64. Don't let the big long "Commodore" word confuse you.

        For more info on the blow-up-your-PET story, try:
        http://www.softwolves.pp.se/misc/arkiv/cbm-h ackers /1/1505.html

        YAW.

    • Re:This just in! (Score:5, Interesting)

      by lord sibn ( 649162 ) on Saturday March 15, 2003 @05:11AM (#5518433)
      Page 7, Paragraph 3:

      "To attack machines without physical access, the attacker can rely on natural memory errors."

      This paper showed some means an attacker could physically cause a memory error, but it never said that such intervention was required to stage the attack. My guess is that this would be most useful with those "low load" ram chips that ran on slashdot a while back.
      • If you wait long enough, then some day a cosmic ray will strike a computer system at exactly the same time as your are entering the root password. The result ionization will cause the compare function to return a match, and you will gain access!
    • While others have pointed out how you've obviously not read the linked article, I'll ask this:

      How do you get physical access to a virtual machine?

    • WOW! Im going to write a scientific paper. Its going to be about how you can crash a Java VM or a Citrix terminal session by repeated blows, via sledgehammer, to the server creating said VM or session.

  • the implications!! (Score:5, Funny)

    by kaworu-sama ( 608217 ) <kaworusama@@@mchsi...com> on Saturday March 15, 2003 @04:21AM (#5518319)
    Now when I benchmark my computer using the punch-the-monkey java applet using a 50 watt spotlight, I'll have to be more careful!

  • A quick workaround... (Score:5, Funny)

    by AnriL ( 657435 ) on Saturday March 15, 2003 @04:36AM (#5518351)
    Just overclock your tamper-resistant machine to the bleeding edge of running at maximum MHz you can get. Tweak the speed to the point that the body heat emitted by regular users will not overheat the CPU, but anyone approaching the machine with a 50 Watt bulb would fry the machine before gaining access to data.

    However, now you get a denial of service attack, but hey, it's better than information disclosure or arbitrary code execution. :-)

  • *.ppt (Score:2, Redundant)

    by hswerdfe ( 569925 )
    Ahhh....... Power Point How I Hate it.....

    Open office did a decent job on it though

  • End of Slashdot (Score:5, Funny)

    by MegaFur ( 79453 ) <.moc.nzz.ymok. .ta. .0dryw.> on Saturday March 15, 2003 @04:55AM (#5518392) Journal
    Oh great, it must be the Apocolypse or something. They actually posted a *link* to a *PowerPoint* document in a Slashdot article! Worse yet, no one seems concerned.

    • Re:End of Slashdot (Score:5, Funny)

      by error0x100 ( 516413 ) on Saturday March 15, 2003 @05:30AM (#5518472)

      They actually posted a *link* to a *PowerPoint* document in a Slashdot article! Worse yet, no one seems concerned.

      Noone reads the articles, so they probably didn't even notice. OK, *I* didn't notice.

    • What's wrong with PowerPoint? There's nothing wrong with PowerPoint! Do you expect people to be able to communicate without PowerPoint? Have you people managed to evolve beyond the PowerPoint stage? I thought that everyone had to send e-mails that contained three bullet points as a PowerPoint attachment. You mean to suggest that there are better ways to do this?!

      But how would you get the bullet items to fly in from the right and dissolve out from a white to gray using plain text? It's just not possi

    • Re:End of Slashdot (Score:4, Informative)

      by zulux ( 112259 ) on Saturday March 15, 2003 @01:14PM (#5519713) Homepage Journal

      Just to infoome people who may not know:

      The file loads just fine in OpenOffice.

      OpenOffice is available free (beer and speech) at OpenOffice.org for Windows, Linux, MAC OS X, FreeBSD and Solaris.

      I'm sure Apple's Keynote works as well.

  • New nifty trick for a hacker book (Score:3, Interesting)

    by bluelan ( 534976 ) on Saturday March 15, 2003 @04:55AM (#5518395)
    You wouldn't necessarily need physical access to the machine itself. It might be possible to perform this exploit by gaining access to a machine's air conditioning unit and disabling it at an inconvenient time. That could raise heat enough to cause RAM performance to degrade and make the success of the exploit more likely.

    If the air conditioner went out at midnight, most system administrators wouldn't know until the morning.

  • I'm reminded of Knuth's quote (Score:5, Insightful)

    by arvindn ( 542080 ) on Saturday March 15, 2003 @04:56AM (#5518396) Homepage Journal
    "Beware of bugs in the above code; I have only proved it correct, not tried it."
    Apparently, the security of the JVM type system has been subject to machine-checked proofs. Yet, a single bit error in memory can be exploited with 70% probability.
    • Yes, well, those proofs work in an abstraction of a machine where memory errors don't occur. The proof is always true, but if the abstraction doesn't model the real world then the proof is meaningless. (Most of the time, though, an attacker doesn't get to cause memory errors in your hardware -- this really only applies to the case where the attacker has physical access to the machine.) It wouldn't be too hard to design a system where memory can instantly change value, and then make another (probabilistic) c

  • This just in... (Score:5, Funny)

    by scubacuda ( 411898 ) <scubacuda@gmai[ ]om ['l.c' in gap]> on Saturday March 15, 2003 @05:00AM (#5518406)
    ...you can fuck up a monitor with a big ass magnet!

    (There are some things you just never forget from your high school physics lab)

    • Can someone explain why a magnet apparently won't damage a black-and-white TV, but it will damage a color TV?
      • Can someone explain why a magnet apparently won't damage a black-and-white TV, but it will damage a color TV?
        I think the magnet messes with both but the effects are dramatically different.
        For B&W, if the beam hitting a spot is displaced by several pixels, its neighbors will be similarly displaced and only a small bit of overall distortion would be noticed.
        Color depends on some rather precise alignments so that the red gun hits the red dots and only the red dots. If the magnet messes with this alignment

      • Re:This just in... (Score:4, Informative)

        by BusterB ( 10791 ) on Saturday March 15, 2003 @09:27AM (#5518897)
        In a color TV, there are three types of phosphors, red, green and blue. The electron guns (or gun in a trinitron) must be aligned so that they hit the correct phosphors. Otherwise, the colors look off. The guns are typically aligned with an appeture mask or grille, which snaps the electron streams into place above their respective phosphors.

        A black-and-white TV has only one type of phosphor, so it is not as important that the electron streams hit the correct, absolute position on the screen. The screen is uniformly coated, and I don't believe there is an appeture screen on these types of screens.

        So, what happens when you hold a magnet to the screen? For one, you deflect the electron streams, so you get a temporarily distorted image, and the colors are off because the electron streams are pointing to the wrong phosphors. With B/W, it just doesn't matter; a phosphor is a phosphor.

        Additionally, a powerful magnet can permanently distort or magnetize the metal appeture mask/grille, causing permanent damage the the screen's ability to align electron streams to the appropriate phosphors.

        And that's it. I may have misspelled appeture. Oh well.

  • In other news. (Score:5, Funny)

    by MisterFancypants ( 615129 ) on Saturday March 15, 2003 @05:10AM (#5518428)
    It turns out that if you have physical access to a system, you can perform a pretty effective denial of service attack using a rather devious little bit of technology called a 'baseball bat'.
    • It turns out that if you have physical access to a system, you can perform a pretty effective denial of service attack using a rather devious little bit of technology called a 'baseball bat'.

      Don't tell Ashcroft, he'll try to ban baseball in the name of national security!

      W
    • Yea, doing this from remote would be a little harder.....

      RING RING, "Hi, um my name is 'Bob', Im from 'The Internet Company'. We think there is a problem and we need you to help us here. Um, we need you to set your computer next to your microwave for a minute. Oh, no can do?...ok, um, you got like a 50 watt lamp you can stick next to your computer case? Ok, good, yea, do that. Oh yea, and go to this java web site.....yea, I can wait..."

      I GUESS you could do some social engineering to get someone to co
    • It turns out that if you have physical access to a system, you can perform a pretty effective denial of service attack using a rather devious little bit of technology called a 'baseball bat'.

      No no no, that is a management tool.

  • best line from the article (Score:5, Funny)

    by zatz ( 37585 ) on Saturday March 15, 2003 @05:11AM (#5518430) Homepage
    Fortunately for the attacker, few users are surprised these days when applications use hundreds of megabytes to accomplish trivial tasks.

  • More elegant way to break a VM (Score:3, Interesting)

    by irc.goatse.cx troll ( 593289 ) on Saturday March 15, 2003 @05:16AM (#5518442) Journal
    Anybody remember the User Mode Linux [securiteam.com] VM escape exploit?
    Seems more elegant than nuking your machine.
    At DefCon X, Gobbles announced a simmiler vulnerability in vmware, though no exploit or advisory has been released so far. For anyone that assumes they're just fear mongering, They also announced the zero day apache bug there, which I'm sure you all remember.

    • For anyone that assumes they're just fear mongering, They also announced the zero day apache bug there, which I'm sure you all remember.

      Just because they've ONCE proven themselves correct doesn't mean they are slightly trustworthy.

      Sure, they announced the OpenBSD/Apache exploit, then went on ranting that they had exploits for every other platform (which they've never yet released).

      Then there is one more I'm sure everyone will remember... They claimed that they were working for the RIAA, and had released

  • If you can manage to sneak an Xray thing in your keychain. If you know where a slot machine's memory is.

  • Make clip on lamps illegal (Score:5, Funny)

    by Alain Williams ( 2972 ) <addw@phcomp.co.uk> on Saturday March 15, 2003 @05:34AM (#5518477) Homepage
    Surely the solution is obvious: make the posession of clip on lamps an offence under the DMCA, I cannot see why someone would want to posess such equipement unless it was to break into a computer and steal the latest music CDs....
  • At first I thought "why don't you just fire a gun instead of expensive x-rays". But once X-ray emitting devices becomes small enough, this could be a new spy gadget. Walk up to the metal detector in the airport. Point your pencil (with built in X-rays) to the scanner and zap it. Then walk right in.

    Or, it can be used for lesser evil stuff as well. In the office. Find the cubicle with the guy that just hates computers. Every time you walk by him to get a cup of coffee, zap his computer with your device. Tr

  • New Computer Cases (Score:5, Funny)

    by ExEleven ( 601282 ) on Saturday March 15, 2003 @05:54AM (#5518514) Homepage
    "New LEAD cases from lian li to protect your system from intuders" Just another thing to worry about when it comes to security.
    • "New LEAD cases from lian li to protect your system from intuders" Just another thing to worry about when it comes to security.

      My LED beats your LEAD ;-) Especially when it is a large LED ;-)

  • Alex descends into hell for a bottle of milk (Score:5, Funny)

    by m00nun1t ( 588082 ) on Saturday March 15, 2003 @05:55AM (#5518516) Homepage
    How many websites would have an article that begins:
    "A very cool scientific paper..."

    Oh dear, we really are geeks, aren't we.

  • a side note about developement of ecc (Score:3, Insightful)

    by bloodbob ( 584601 ) on Saturday March 15, 2003 @06:00AM (#5518530)
    I Believe I could be mistaken but the guy who made up the finite state machine for ECC had a mental break down. Making something like that is very complex I wonder how long parity checks which offer no correction where thought to be state of the art.
  • From the article:
    Because the attack requires very large amounts of memory to operate efficiently, the application in which it's hidden would itself have to be a memory hog. Fortunately for the attacker, few users these days are surprised when applications use hundreds of megabytes to accomplish trivial tasks.

    Makes you think about ICQ, doesn't it?

  • Reminds me when I was bored, and decided to take a look at the inside of a new (at the time) Atari 2600.

    Even at that age, I knew the system wasn't too complex...one chip-per-game, less than a couple dozen pins teasingly poking out the back. Hmmmm...about the width of a screwdriver. TV connected, power on, and screwdriver in hand, in went my Adventure game cartridge. Pin 1+2, garbage, reset. Pin 2+3, more garbage, reset. Pin 3+4...hmmm. After a while, I moved on to short pieces of wire.

    Some pin com

  • ECC for making machines .... **cheaper** ! (Score:5, Insightful)

    by Morgaine ( 4316 ) on Saturday March 15, 2003 @09:00AM (#5518852)
    This (excellent) paper alludes to the usual situation that cheaper machines tend not to use ECC in memory modules and in other parts of their architecture in order to save on manufacturing costs.

    Note however that this common perception is not strictly speaking entirely accurate or necessary, because if a system is designed to meet a given level of reliability then a machine with ECC may end up being cheaper than one without ECC, because the error detection and correction can make up for reduced reliability in the rest of the hardware.

    As an example, some components may be run closer to their operating limits, possibly partially overclocked, or power supplies may be less well regulated and hence electronic noise margins may be slightly compromised, or the system may be designed with substandard cooling, and so on. ECC could help mitigate some of the effects of such presumably cheaper designs, while still maintaining the reliability of better implementions.

    So, there's slightly more to the "ECC only found in better systems" argument than at first meets the eye. As usual, caveat emptor. :-)
    • A system made with junk hardware, for example all defective components that failed QA tests, but sufficient redundancy and error correction to run normally. Mass storage that can *maybe* store a terabyte on a CD-size disk, with astronomical error rate and error-correction software that gets 100G in reliably. Processors that run overclocked by design and have extra circuits to correct occasional failures. Any takers?
  • Sorry. My browser does not render powerpoint.

  • Excellent Smithers!!! (Score:3, Funny)

    by Pedrito ( 94783 ) on Saturday March 15, 2003 @10:27AM (#5519073)
    This is the last step I needed in my Java trojan I've been writing. Now all I need to do is go to everyone's house with my x-ray machine, and I'm in like Flint!

  • In the lab today, in the wild tomorrow... (Score:4, Interesting)

    by donert ( 415534 ) on Saturday March 15, 2003 @10:29AM (#5519079)

    This is good stuff. Although the experiment used physical access to stress the memory, the theory could be used as an exploit in real situations in ways that the narrow of mind (like me) cannot conceive.

    Perhaps this is not a method of practical attack on a machine. But it may be just a matter of creative thinking.

    The key take away is to not disallow the possiblity.

    Threats you discard as harmless is a logical place for an attacker to begin. Remeber the Maginot line [straightdope.com].

  • The article says that if you can get close enough to zap a box with xrays and simultaneously get the box to let your Java code use 60% of the memory and if the machine does not hang then you have a 70% chance of getting root. And the RAM has to be non ECC RAM.
    Looks like all xSeries servers from IBM and Dell(Power Edges) and HP ship only with ECC RAM , and ECC errors are actually logged by software.
    So forget walking into Las Vegas Casinos with a Xray machine.

  • Even submitters don't read the article (Score:4, Interesting)

    by dmadole ( 528015 ) on Saturday March 15, 2003 @10:43AM (#5519125)
    I expect posters to not read the article (well, ppt), but even the submitter didn't read it?

    The article does mention x-rays, saying "not enough energy to change a DRAM capacitor." Yet everyone talks about x-rays...

    I found the phrase from the article "screw driver to remove hard drive" amusing when I first read it. Then I realized they meant "screwdriver". I thought initially they were referring to a DOS attack by corrupting the device driver!

  • palladium (Score:5, Insightful)

    by astrashe ( 7452 ) on Saturday March 15, 2003 @11:23AM (#5519275) Journal
    One use for this sort of thing might be to get a palladium system to do something it's not supposed to. In that case you'd have access to your own machine.

    Palladium is just a specialized VM that runs on tamper proof hardware, that's designed to let other people trust the results of some computations performed on your machine.

  • Neons (Score:2, Funny)

    by hansroy ( 575558 )
    Good. Maybe all those kids with neon lights in their cases will have the same problem. I'm sure case modding was fun for awhile, but when every mod has to include the basic package of lights, fans, etc., it becomes too stock. Just like every '89 Civic I see with cut springs & an F1 wing. Yes, I am grumpy when I wake up.
  • The fact that most desktop/laptop and some server computers shipping today have no type of memory error detection or correction.

    Back in the older days _all_ computers shipped with at least parity memory. Today you get no checking unless you buy a workstation or server class machine.

    Did you ever notice that when you build an IBM system on-line that they make it very clear that the system uses non-parity memory where other companies never mention this? I think they know that someday someone will bring for
  • Aerospace researchers have been investigating the effects of different types of radiation on computers and other electronics for decades. Why would a virtual machine be any different, whether on a PC board, or on a smart card?

    It is often questioned on this site as to why spacecraft do not use the latest/greatest computing equipment available. It is because the flight-capable designs have proven themselves tolerant of harsh environments, including alpha/beta/X radiation. (And other things, like low p


  • I've always thought that the JVM security model was the moral equivalent of eliminating the FDA in favour of tamper resistant pill bottles.

    Tamper resistant packaging is a darn good idea. But it's not a good idea to be so impressed by the packaging that we forget that how easily well intentioned people can create combinations of carbon, hydrogen, and oxygen and a few choice flavour additives that kill.

    Bottom line: no matter how much rocket science you pour into the packaging, you still have to ask hard qu

    • I've always thought that the JVM security model was the morla equivalent of eliminating the FDA in favour of tamper resistant pill bottles.

      That's a very bad analogy. Tamper-resistant pill bottles are supposed to ensure that no one other than the manufacturer has done anything to the contents. They do nothing unless the consumer trusts the manufacturer. The computer equivalent of tamper-resistant pill bottles is programs digitally signed by the author.

      This is entirely unlike the JVM security model. I

  • It was a pleasant surprise to see my paper on /. this morning. Now pdf slides are available here [princeton.edu]. My comments on the views shared here are also available [princeton.edu]. Sudhakar [princeton.edu].

  • I don't know if anyone bothered to read the paper, (Score:3, Informative)

    by voodoo1man ( 594237 ) on Saturday March 15, 2003 @09:08PM (#5521587)
    But technically this isn't an attack on all sand-box virtual machines, just the early-binding ones like the JVM, which assume a program is safe to run after a single check at compile/link time. Late-bound (or dynamically typed) VM-based languages such as Smalltalk and Lisp aren't as vulnereable to this - only the memory allocation and other atomic system functions that are assumed "safe" are vulnereable, and typically there are only a couple of dozen of these (and a random cooking of which is very likely to crash the VM or the machine by their nature). Of course, randomly messing with the memory will cause program errors and undesired results, and compilers that do a lot of inlining and type assumption optimizations increase the risk.
  • Why were we wasting all our time on buffer overflows and cryptography, when the real threat all along has been...

    COSMIC RAYS!!
  • I watched the power-point, because I was really curious how to provide this exploit. Looking at his example, I was really curious when I saw his Java code contained the line "for each pointer p of type A"... Pointer? You don't have direct access to pointers. What is he doing?

    Watch further and it all makes sense. He said that Java is vulnerable to these memory errors, and that you can prove it by adding some non-Java code. Well, no S*&t! Has anyone ever doubted that you can do whatever the hell you

  • A long time ago, when I worked at a restaurant as a teenager, I saw an employee that was screwing around with an ion ray gun [plans-kits.com] accidentally open a secure time-lock safe. He simply pointed it at the safe from a few inches away and the safe's electronic display started blinking and it just opened.

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close