Using Rowhammer bitflips to root Android phones is now a thing | Ars Technica

http://arstechnica.com/security/2016/10/using-rowhammer-bitflips-to-root-android-phones-is-now-a-thing/

Rowhammer hardware bug is now a security issue for both PCs and smart phones. 

5 Comments

  1. Tomi Engdahl says:

    Rowhammer Attack Can Now Root Android Devices
    https://news.slashdot.org/story/16/10/24/2232220/rowhammer-attack-can-now-root-android-devices

    Researchers have discovered a method to use the Rowhammer RAM attack for rooting Android devices. For their research paper, called Drammer: Deterministic Rowhammer Attacks on Mobile Platforms, researchers tested and found multiple smartphone models to be vulnerable to their attack. The list includes LG Nexus (4, 5, 5X), LG G4, Motorola Moto G (2013 and 2014), One Plus One, HTC Desire 510, Lenovo K3 Note, Xiaomi Mi 4i, and Samsung Galaxy (S4, S5, and S6) devices. Researchers estimate that millions of Android users might be vulnerable. The research team says the Drammer attack has far more wide-reaching implications than just Android, being able to exploit any device running on ARM chips. In the past, researchers have tested the Rowhammer attack against DDR3 and DDR4 memory cards, weaponized it via JavaScript, took over PCs via Microsoft Edge, and hijacked Linux virtual machines. There’s an app to test if your phone is vulnerable to this attack.

    Rowhammer Attack Can Now Root Android Devices
    After Windows & Linux, Rowhammer takes over Android as well
    Read more: http://news.softpedia.com/news/rowhammer-attack-can-now-root-android-devices-509585.shtml#ixzz4O6JeoVDZ

    Reply
  2. Tomi Engdahl says:

    Drammer: Deterministic Rowhammer Attacks on Mobile Platforms
    https://vvdveen.com/publications/drammer.pdf

    Recent work shows that the Rowhammer hardware bug can
    be used to craft powerful attacks and completely subvert a
    system. However, existing e orts either describe probabilis-
    tic (and thus unreliable) attacks or rely on special (and often
    unavailable) memory management features to place victim
    objects in vulnerable physical memory locations. Moreover,
    prior work only targets x86 and researchers have openly won-
    dered whether Rowhammer attacks on other architectures,
    such as ARM, are even possible.
    We show that
    deterministic
    Rowhammer attacks are feasi-
    ble on commodity
    mobile platforms
    and that they cannot be
    mitigated by current defenses. Rather than assuming special
    memory management features, our attack,
    Drammer
    , solely
    relies on the predictable memory reuse patterns of standard
    physical memory allocators. We implement
    Drammer
    on
    Android/ARM, demonstrating the practicability of our at-
    tack, but also discuss a generalization of our approach to
    other Linux-based platforms. Furthermore, we show that
    traditional x86-based Rowhammer exploitation techniques
    no longer work on mobile platforms and address the resulting
    challenges towards practical mobile Rowhammer attacks

    Native binary for testing Android phones for the Rowhammer bug
    https://github.com/vusec/drammer

    Reply
  3. Tomi Engdahl says:

    Researchers Propose Software Mitigations for Rowhammer Attacks
    http://www.securityweek.com/researchers-propose-software-mitigations-rowhammer-attacks

    A team of researchers has proposed two software-based methods that could be used to mitigate Rowhammer, a type of attack that exploits weaknesses in the design of dynamic random-access memory (DRAM).

    Rowhammer attacks are possible due to increasing DRAM density, which has led to memory cells being physically smaller and closer together. If a row is accessed repeatedly, it causes bit flips in adjacent memory rows.

    The first working privilege escalation exploits leveraging Rowhammer were disclosed by Google researchers in March 2015. Experts later created a JavaScript implementation, and they recently demonstrated that the attack can even be used to root some Android devices.

    Rowhammer attacks are not easy to mitigate, particularly using software. The most efficient mitigation involves redesigning DRAM modules. However, researchers from the Technische Universität Darmstadt and the University of Duisburg-Essen in Germany have now come up with what they call “practical and generic software-only defenses.”

    The first method, dubbed B-CATT, doesn’t require any changes to the OS and it can be used on all x86 systems. B-CATT is a bootloader extension that locates and disables vulnerable physical memory. Vulnerable memory addresses are identified using existing Rowhammer exploitation tools. Since OSs are designed to handle unavailable memory regions, B-CATT should not break any system functionality, researchers said.

    The second mitigation, G-CATT (Generic-CATT), aims to prevent bit flips from affecting memory locations belonging to high-privileged security domains, such as the kernel and co-located virtual machines. It does this by ensuring that memory between the row controlled by the attacker and the row storing the targeted data are separated by at least one row.

    The researcher believes the B-CATT idea is “fairly good,” but there are some weak points,

    CAn’t Touch This: Practical and Generic Software-only Defenses Against Rowhammer Attacks
    https://arxiv.org/pdf/1611.08396v1.pdf

    Reply
  4. Tomi Engdahl says:

    Rowhammer RAM attack adapted to hit flash storage
    Project Zero’s two-year-old dog learns a new trick
    https://www.theregister.co.uk/2017/08/17/rowhammer_for_nand_flash/

    It’s Rowhammer, Jim, but not as we know it: IBM boffins have taken the DRAM-bit-flipping-as-attack-vector trick found by Google and applied it to MLC NAND Flash.

    Google’s Project Zero found Rowhammer in 2015, when they demonstrated that careful RAM bit-flipping in page table entries could let an attacker pwn Linux systems.

    Ever since Project Zero’s initial result, boffins have looked for other vectors or other victims (for example, it was turned into an Android root attack in 2016).

    Enter a group of boffins from IBM Research Zurich, who plan to demo a Rowhammer attack on MLC NAND flash after explaining it at this week’s Usenix-organised W00T17 conference in Vancouver.

    Scary? Yes, but there’s a couple of slivers of good news: it’s a local rather than a remote attack, and the researchers constrained themselves to a filesystem-level attack rather than a full-system attack.

    The bad news is that Rowhammer-for-NAND can work at lower precision than its ancestor: while the original Google research worked by flipping single bits, “ the attack primitive an attacker can obtain from MLC NAND flash weaknesses is a coarse granularity corruption”.

    In other words, their “weaker attack primitive … is nevertheless sufficient to mount a local privilege escalation attack”.

    To get that far, the research explain in this paper [PDF], an attack has to beat protections at all layers from the Flash chip up to the operating system:

    Cell-to-cell interference protections on the chip;</li
    The Flash controller's scrambling and error correction codes, that are designed to increase device reliability;
    Wear-levelling and block placement algorithms in the SSD controller make memory placement less predictable, from the attacker's point of view;
    Filesystem protections like caching and error detection have to be bypassed.

    Only then does the attacker get to present their payload.

    https://www.usenix.org/system/files/conference/woot17/woot17-paper-kurmus.pdf

    Reply
  5. Tomi Engdahl says:

    Attacking a co-hosted VM: A hacker, a hammer and two memory modules
    https://thisissecurity.stormshield.com/2017/10/19/attacking-co-hosted-vm-hacker-hammer-two-memory-modules/

    Row-hammer is hardware bug that can cause bit-flips in physical RAM. Mark Seaborn and Thomas Dullien were the first to exploit the DRAM row-hammer bug to gain kernel privileges. Kaveh Razavi et al. pushed the exploitation of row-hammer bugs to the next level. They abused an OS feature – memory de-duplication – to surgically flip bits in a controlled way. They succeeded in flipping bits in memory loaded sensitive files (e.g. authorized_keys) assuming they know their contents. By weakening RSA moduli in authorized_keys file, they were able to generate corresponding private keys and authenticate on a co-hosted victim VM.

    we aim to showcase a different attack scenario. Instead of corrupting memory loaded files, we chose to corrupt the state of a running program. The libpam is an attractive target since it provides authentication mechanisms on widely deployed *nix systems.

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

*

*