December 5, 2016 By Larry Loeb 2 min read

Rowhammer is a specific kind of attack that involves an exploit of the physical hardware in dynamic random-access memory (DRAM). It changes the contents of the memory stored at a given location, which can contribute to unauthorized user escalation and other undesirable consequences.

DRAMs have grown denser over time, leading to interactions between adjacent rows of memory. Google researchers first noted this attack in March 2015. Recently, it was improved with the added capability to root Android phones.

Slamming Rowhammer

So far, the best mitigation technique is a physical redesign of DRAM to eliminate the bit flipping that occurs in adjacent memory rows after repeated read/writes to a specific location. But this kind of solution ignores the vulnerable devices that have been produced and are currently in use.

In response, researchers from the Technische Universität Darmstadt and the University of Duisburg-Essen in Germany devised two methods that use software to mitigate these kinds of attacks.

The first method, called B-CATT, requires no changes to the OS and is compatible with all x86 systems, according to SecurityWeek. It is a bootloader extension designed to locate and disable any exploitable physical memory. It also identifies memory locations vulnerable to Rowhammer and marks them as unavailable to the system for storage.

The second method, G-CATT, aims to protect the memory locations that correspond to high-privileged security domains. It stops bit flips in those strategic locations by making sure that the user memory from which an attack could be launched is physically at least one row away from those critical areas.

Experts Not Impressed

Other researchers were only moderately impressed by the mitigation. Based on their first impressions, some thought it was an important contribution, but most emphasized that there were several issues that still needed to be addressed.

One researcher told SecurityWeek that the proposed method “does not break Rowhammer completely, it only prevents the strong double-sided Rowhammer. Furthermore, an attack from one application to another is also not prevented, only from user applications to the kernel.”

Rowhammer-style attacks are still possible, but researchers will likely find a working mitigation eventually.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today