Flip Feng Shui Victor van der Veen and
- Slides: 112
Flip Feng Shui Victor van der Veen and Kaveh Razavi
VUSec. net Binary Armoring Malware Analysis Hardware Vulnerabilities Flip Feng Shui @ Surf – February 9, 2017 Introduction Mobile Security Software Reliability Software Testing 2
Flip Feng Shui Your takeaway message of today Even if we could build perfect software. . . Flip Feng Shui @ Surf – February 9, 2017 Introduction 3
Flip Feng Shui Your takeaway message of today Even if we could build perfect software. . . Without any security bugs whatsoever. . . Flip Feng Shui @ Surf – February 9, 2017 Introduction 4
Flip Feng Shui Your takeaway message of today Even if we could build perfect software. . . Without any security bugs whatsoever. . . A single hardware bit flip can compromise it. Flip Feng Shui @ Surf – February 9, 2017 Introduction 5
Flip Feng Shui in 2016 The art of turning bit flips into a reliable compromise… … of the cloud • Hammering a Needle in the Software Stack @ USENIX Security … of the browser • Dedup Est Machina @ IEEE Security & Privacy … of the mobile • Drammer @ ACM CCS Dutch high quality research at top venues in computer security Best research group in the world in 2016 (better than MIT!) Flip Feng Shui @ Surf – February 9, 2017 Introduction 6
Flip Feng Shui Worldwide impact Ars. Technica, WIRED, The Register, Infoworld, Slashdot, The Stack, Softpedia, Science Daily, CORDIS, Security Now!, Daily Mail, Tech Times, Fossbytes, The Inquirer, Hack Read, Threatpost Argentina (Segu-info), Austria (Der Standard), Belgium (De. Morgen), China (Freebuff, Sohu, EEPW), Czech Republic (Svět Androida), Denmark (Version 2), France (Silicon, Le Monde Informatique, Informanews), Germany (Der Spiegel, Golem. de, Pro-Linux, Crn. de, JAXenter, Computer Bild, t 3 n Magazine, Netzwelt. de), Hungary (HWSW), Italy (Repubblica. it, Punto Informatico, Gadgetblog. it, Tutto Android), Mexico (PCWorld Mexico), The Netherlands (NU. nl, Tweakers. net, Crimesite), Norway (Digi. no), Poland (e. Gospodarka, Softonet, PCLab. pl, Dobreprogramy, PC Format, Telix. pl), Russia (Хакер, Securitylab. ru), Slovakia (Živé. sk), Spain (López Dóriga, CSO, El Android libre), Switzerland (Neue Zürcher Zeitung), Taiwan (i. Thome), Turkey (Teknokulis, CHIP, Webtekno), and Ukraine (KO). • Powerful Bit-Flipping Attack Bruce Schneier • This is a significant finding, thanks for Researching it Mark Seaborn, Google • This is an issue that will affect almost any modern computer system Hugo Vincent, ARM Research • We appreciate your assistance in helping to maintain and improve the security of our products. Cristina Formaini, Apple Flip Feng Shui @ Surf – February 9, 2017 Introduction 7
INTRODUCTION Flip Feng Shui @ Surf – February 9, 2017 Introduction 8
Flip Feng Shui Requirements 1. A reproducible hardware bit flip Rowhammer – a widespread DRAM issue 2. Ability to target the bit flip Predictable memory management behavior Flip Feng Shui @ Surf – February 9, 2017 Introduction 9
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 10
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 11
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 12
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 13
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 14
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 15
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 16
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 17
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 1 1 0 0 0 1 Flip Feng Shui @ Surf – February 9, 2017 Introduction 18
Rowhammer A DRAM hardware glitch Single-Sided Rowhammer 1 1 0 0 0 1 1 0 0 0 1 Aggressor row Victim row • Not every bit may flip • Once a bit flips, we can often reproduce it Flip Feng Shui @ Surf – February 9, 2017 Introduction 19
Rowhammer A DRAM hardware glitch Single. Double-Sided Rowhammer 1 1 0 0 0 1 1 0 0 0 1 Aggressor row 1 Victim row Aggressor row 2 • Sandwich the victim row by alternating accesses • Increased chance of flipping a bit Flip Feng Shui @ Surf – February 9, 2017 Introduction 20
Bypass the CPU cache Solution: cache flush Tell the CPU to remove data from the cache Solution: cache eviction Read more data until the cache is full CPU Flip Feng Shui @ Surf – February 9, 2017 Cache Introduction 1 1 0 0 1 1 0 0 0 1 DRAM 21
Flip Feng Shui Mechanics 1. Memory templating Scan memory for useful bit flips 2. Land sensitive data Store sensitive data on a vulnerable location 3. Reproduce the bit flip Modify the sensitive data to compromise the system Flip Feng Shui @ Surf – February 9, 2017 Introduction 22
SCENARIO 1 Kaveh Razavi, Ben Gras, Erik Bosman, Bart Preneel, Cristiano Giuffrida, and Herbert Bos HAMMERING A NEEDLE IN THE SOFTWARE STACK USENIX Security August 2016 Flip Feng Shui @ Surf – February 9, 2017 Scenario 1: Breaking the Cloud 23
Hammering a Needle in the Software Stack • • • Malicious VM in the cloud compromising neighbors Rowhammer + Memory Deduplication You can flip a bit in another VM What would YOU flip? Flip Feng Shui @ Surf – February 9, 2017 Scenario 1: Breaking the Cloud 24
Memory templating Victim and Attacker share hardware • Attacker has access to the same physical memory as the victim • Attacker is root on his own VM: use cache flush to Rowhammer Victim VM Attacker VM Hypervisor Hardware Layer CPU – DRAM – Caches - … Scenario 1: Breaking the Cloud
Memory templating Victim and Attacker share hardware • Attacker has access to the same physical memory as the victim • Attacker is root on his own VM: use cache flush to Rowhammer Victim VM Attacker VM Hypervisor 0000000000000000000000000000000000000000000000000 g 1111111111111111111111111111111111111111111111111 0000000000000000000000000000000000000000000000000 Scenario 1: Breaking the Cloud
Memory templating Victim and Attacker share hardware • Attacker has access to the same physical memory as the victim • Attacker is root on his own VM: use cache flush to Rowhammer Victim VM Attacker VM Hypervisor 0000000000000000000000000000000000000000000000000 1111111111111111111111111111111111111111111111111 0000000000000000000000000000000000000000000000000 Scenario 1: Breaking the Cloud
Memory templating Victim and Attacker share hardware • Attacker has access to the same physical memory as the victim • Attacker is root on his own VM: use cache flush to Rowhammer Victim VM Attacker VM Hypervisor 0000000000000000000000000000000000000000000000000 1111111111111111111111111111111111111111111111111 0000000000000000000000000000000000000000000000000 Scenario 1: Breaking the Cloud
Memory templating Victim and Attacker share hardware • Attacker has access to the same physical memory as the victim • Attacker is root on his own VM: use cache flush to Rowhammer Victim VM Attacker VM Hypervisor 0000000000000000000000000000000000000000000000000 11111111111011111111111111111111111111111111111111 0000000000000000000000000000000000000000000000000 Scenario 1: Breaking the Cloud
Memory templating Victim and Attacker share hardware • Attacker has access to the same physical memory as the victim • Attacker is root on his own VM: use cache flush to Rowhammer Victim VM Attacker VM Hypervisor Bit Flip 0000000000000000000000000000000000000000000000000 11111111111011111111111111111111111111111111111111 0000000000000000000000000000000000000000000000000 Scenario 1: Breaking the Cloud
Land sensitive data Given a bit flip in the Attacker VM How do we force the Victim VM to store sensitive data here? Memory Deduplication Victim VM Attacker VM Hypervisor 0000000000000000000000000000000000000000000000000 11111111111011111111111111111111111111111111111111 0000000000000000000000000000000000000000000000000 Scenario 1: Breaking the Cloud
Land sensitive data Memory deduplication Victim VM Attacker VM Hypervisor X? Scenario 1: Breaking the Cloud
Land sensitive data Memory deduplication • Operating System / Hypervisor searches for duplicate pages buf = malloc(. . . ) Victim VM 0 xbff 00000 0 xbff 40000 0 xbff 80000 buf = malloc(. . . ) Attacker VM Hypervisor 10111 10100 11100 Scenario 1: Breaking the Cloud 0 xbf 610000 0 xbf 650000 0 xbf 690000
Land sensitive data Memory deduplication • Operating System / Hypervisor searches for duplicate pages buf = malloc(. . . ) Victim VM 0 xbff 00000 0 xbff 40000 0 xbff 80000 buf = malloc(. . . ) Attacker VM Hypervisor 10111 10100 11100 Scenario 1: Breaking the Cloud 0 xbf 610000 0 xbf 650000 0 xbf 690000
Land sensitive data Memory deduplication • Operating System / Hypervisor searches for duplicate pages • Frees the duplicated bytes from physical memory • Updates the virtual address mapping But what should we flip? buf = malloc(. . . ) Victim VM 0 xbff 00000 0 xbff 40000 0 xbff 80000 buf = malloc(. . . ) Attacker VM Hypervisor 10111 10100 11100 Scenario 1: Breaking the Cloud 0 xbf 610000 0 xbf 650000 0 xbf 690000
Land sensitive data What should we land? Cryptographic keys + Domain names Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys Public RSA key from. ssh/authorized_keys Victim VM Attacker VM Hypervisor ssh-rsa AAAAB 3 Nza. C 1 yc 2 EAAAADAQABl 8 h 0 Vf. Rb. C 7 na. Vs. . . Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys Public RSA key from. ssh/authorized_keys • Flipping a bit changes the public/private key pair Victim VM Attacker VM Hypervisor ssh-rsa AAAAB 4 Nza. C 1 yc 2 EAAAADAQABl 8 h 0 Vf. Rb. C 7 na. Vs. . . Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys Public RSA key from. ssh/authorized_keys • • Flipping a bit changes the public/private key pair New public key is easy to factorize Victim VM P =. . . Q =. . . Attacker VM Hypervisor ssh-rsa AAAAB 4 Nza. C 1 yc 2 EAAAADAQABl 8 h 0 Vf. Rb. C 7 na. Vs. . . Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys Public RSA key from. ssh/authorized_keys • • • Flipping a bit changes the public/private key pair New public key is easy to factorize Attacker computes the new private key and gets SSH access Victim VM id_rsa =. . . Attacker VM Hypervisor ssh-rsa AAAAB 4 Nza. C 1 yc 2 EAAAADAQABl 8 h 0 Vf. Rb. C 7 na. Vs. . . Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade Victim VM Attacker VM Hypervisor security. ubuntu. com/ubuntu Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade • Flipping a bit changes the domain name used to pull updates • Attacker hosts malicious ls command at ubunvu. com Victim VM Attacker VM Hypervisor security. ubunvu. com/ubuntu Scenario 1: Breaking the Cloud
3. Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade • Flipping a bit changes the domain name used to pull updates • Attacker hosts malicious ls command at ubunvu. com • Packages are signed: also flip a bit in the GPG keychain Victim VM Attacker VM Hypervisor security. ubunvu. com/ubuntu Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade • Flipping a bit changes the domain name used to pull updates • Attacker hosts malicious ls command at ubunvu. com • Packages are signed: also flip a bit in the GPG keychain Victim VM Attacker VM Hypervisor /etc/apt/trusted. gpg: m. QGi. BEFEnz 8 RBAC 7 Ls. . . security. ubunvu. com/ubuntu Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade • Flipping a bit changes the domain name used to pull updates • Attacker hosts malicious ls command at ubunvu. com • Packages are signed: also flip a bit in the GPG keychain Victim VM Attacker VM Hypervisor /etc/apt/trusted. gpg: m. QGi. BDFEnz 8 RBAC 7 Ls. . . security. ubunvu. com/ubuntu Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade • • Flipping a bit changes the domain name used to pull updates Attacker hosts malicious ls command at ubunvu. com Packages are signed: also flip a bit in the GPG keychain Attacker computes the new GPG key and signs his backdoored ls Victim VM Attacker VM Hypervisor /etc/apt/trusted. gpg: m. QGi. BDFEnz 8 RBAC 7 Ls. . . security. ubunvu. com/ubuntu Scenario 1: Breaking the Cloud
Reproduce the bit flip Cryptographic keys + domain names Domain name used for apt-get upgrade • • • Flipping a bit changes the domain name used to pull updates Attacker hosts malicious ls command at ubunvu. com Packages are signed: also flip a bit in the GPG keychain Attacker computes the new GPG key and signs his backdoored ls Wait for victim to apt-get upgrade Victim VM Attacker VM Hypervisor /etc/apt/trusted. gpg: m. QGi. BDFEnz 8 RBAC 7 Ls. . . security. ubunvu. com/ubuntu Scenario 1: Breaking the Cloud
Disclosure Contacted NCSC on June 9, 2016 • Good job on contacting vendors and affected parties! • GPG Patch so that self-signed keys are no longer valid Bought some domains for ubuntu/debian • • ubunvu. com ubuftu. com ubunte. com ubuntt. com ubuntw. com ubun 4 u. com ubunuu. com Flip Feng Shui @ Surf – February 9, 2017 • • dabian. org ddbian. org debiaf. org debicn. org debial. org debiqn. org debien. org Scenario 1: Breaking the Cloud And more. . . 48
SCENARIO 2 Erik Bosman, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida DEDUP EST MACHINA IEEE Security & Privacy (Oakland) May 2016 Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 49
Dedup Est Machina • • Compromise Microsoft Edge with all defenses up without a software vulnerability Use memory deduplication as a side channel to leak heap and code pointers The leaked pointers are useful in the Flip Feng Shui attack Aim: compromise the browser process from Java. Script Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 50
Memory templating Use cache eviction buffers to read from memory Java. Script Typed Array Java. Script Array Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 51
Memory templating Hammering Strategy ! s Single-sided Rowhammer lf ip t i b t p i r c Rowbuffer: find bank conflicts s a v a Cache coloring: find cache sets Java. Script Array Java. Script: no physical addresses J Flip Feng Shui @ Surf – February 9, 2017 probablistic double-sided Scenario 2: Breaking the Browser 52
Land sensitive data Java. Script References Java. Script Array Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 53
Land sensitive data Java. Script References Java. Script Array Flip Feng Shui @ Surf – February 9, 2017 Typed Array Scenario 2: Breaking the Browser 54
Land sensitive data Java. Script References Java. Script Array Typed Array vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 55
Land sensitive data Java. Script References Java. Script Array Flip Feng Shui @ Surf – February 9, 2017 Typed Array Scenario 2: Breaking the Browser 56
Land sensitive data Java. Script References Java. Script Array Typed Array Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 57
Reproduce the bit flip Java. Script Array Typed Array Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 58
Reproduce the bit flip Java. Script Array Typed Array Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 59
Reproduce the bit flip Java. Script Array Typed Array Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 60
Reproduce the bit flip Java. Script Array Typed Array Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 61
Reproduce the bit flip Java. Script Array Typed Array Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 62
Reproduce the bit flip Counterfeit Object vtable pointer size Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 63
Reproduce the bit flip Counterfeit Object vtable pointer size Arbitrary read/write over memory Take over Edge without a software bug Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 64
Disclosure Talked to Microsoft on March 7, 2016 • Memory deduplication was disabled on July 18, 2016 Most innovative research! Black Hat USA 2016 Flip Feng Shui @ Surf – February 9, 2017 Scenario 2: Breaking the Browser 65
SCENARIO 3 Victor van der Veen, Yanick Fratantonio, Martina Lindorfer, Daniel Gruss, Clementine Maurice, Giovani Vigna, Herbert Bos, Kaveh Razavi, and Cristiano Giuffrida DRAMMER ACM CCS October 2016 Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 66
Drammer • • Can we use Rowhammer to root Android phones? Targeting ARM instead of x 86 Android devices do not have memory deduplication Exploit behavior of underlying memory allocator Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 67
Memory Templating Bypassing the CPU cache • Cache eviction Too slow • Explicit cache flush (clflush instruction) Privileged Does this work on ARM? Of course not Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 68
Memory templating Bypass the CPU cache Sometimes CPU caches are detrimental GPU Offload specific tasks to dedicated hardware • Devices for graphics / audio / … • CPU gets to do other tasks in parallel • DMA: Direct Memory Access CPU Flip Feng Shui @ Surf – February 9, 2017 Cache Scenario 3: Breaking the Mobile 1 1 0 0 1 1 0 0 0 1 DRAM 69
Land sensitive data Threat-Model • Recent Android OS without memory deduplication (too costly) • Unprivileged app wants to get root access Goal: read/write access to anywhere in memory • Find administrative kernel data structures for our process • Overwrite our own uid to get root access Approach 1. Land a Page Table at the vulnerable location 2. Flip a bit in a Page Table Entry! Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 70
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 140000 0 x 0 c 0000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) 1 0 Hello 0 x 140000 0 b 101000000000 0 xb 6 a 58000 0 x 0 c 0000 0 b 011000000000 Flip Feng Shui @ Surf – February 9, 2017 … (binary) 0 xb 6 a 57000 Where are page tables stored? … 0 b 101000000000 0 b 011000000000 In memory! Scenario 3: Breaking the Mobile 71
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 140000 0 x 0 c 0000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 140000 0 b 101000000000 0 xb 6 a 58000 0 x 0 c 0000 0 b 011000000000 What if we flip a bit in a page table? Flip Feng Shui @ Surf – February 9, 2017 … 0 b 101000000000 0 b 011000000000 Scenario 3: Breaking the Mobile Modify mappings! 72
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 140000 0 x 0 c 0000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 140000 0 b 10000000000 0 xb 6 a 58000 0 x 0 c 0000 0 b 011000000000 What if we flip a bit in a page table? Flip Feng Shui @ Surf – February 9, 2017 … 0 b 10000000000 0 b 011000000000 Scenario 3: Breaking the Mobile Modify mappings! 73
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 100000 0 x 0 c 0000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 100000 0 b 10000000000 0 xb 6 a 58000 0 x 0 c 0000 0 b 011000000000 What if we flip a bit in a page table? Flip Feng Shui @ Surf – February 9, 2017 … 0 b 10000000000 0 b 011000000000 Scenario 3: Breaking the Mobile Modify mappings! 74
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 100000 0 x 0 c 0000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 100000 0 b 10000000000 0 xb 6 a 58000 0 x 0 c 0000 0 b 011000000000 What if we flip a bit in a page table? Flip Feng Shui @ Surf – February 9, 2017 … 0 b 10000000000 0 b 011000000000 Scenario 3: Breaking the Mobile Modify mappings! 75
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 100000 0 x 0 c 0000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) … 0 b 10000000000 0 b 011000000000 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 100000 0 b 10000000000 0 xb 6 a 58000 0 x 0 c 0000 0 b 011000000000 Page tables give us read/write access to anywhere in memory Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 76
Land sensitive data Page tables Mapping virtual addresses to physical addresses 0 x 040000 buf = malloc(8196); sprintf(buf, “Hello World”); 0 x 080000 0 xb 6 a 57000 0 x 0 c 0000 0 xb 6 a 58000 0 x 100000 1 1 0 1 … 1 0 1 1 … 0 1 World 1 0 … Virtual Address 1 1 Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 x 100000 0 x 040000 0 0 0 x 140000 Page table Virtual Address Physical Address 0 1 (binary) … 0 b 10000000000 0 b 001000000000 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 100000 0 b 10000000000 0 xb 6 a 58000 0 x 040000 0 b 001000000000 By modifying existing entries… Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 77
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 xb 6 a 59000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 0 x 140000 1 1 0 1 … 1 0 1 1 … 0 1 Virtual Address 0 xb 6 a 57000 0 xb 6 a 58000 0 xb 6 a 59000 Page table Virtual Address Physical Address World 1 0 … Physical Address (binary) 0 x 100000 0 x 040000 0 x 080000 0 b 10000000000 0 b 001000000000 0 b 010000000000 1 1 0 0 0 1 … 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 100000 0 b 10000000000 0 xb 6 a 58000 0 x 040000 0 b 001000000000 0 xb 6 a 59000 0 x 080000 0 b 010000000000 By modifying existing entries… or by adding new ones Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 78
Land sensitive data Page tables Mapping virtual addresses to physical addresses buf = malloc(8196); sprintf(buf, “Hello World”); 0 xb 6 a 57000 0 xb 6 a 58000 0 xb 6 a 59000 0 x 040000 0 x 080000 0 x 0 c 0000 0 x 100000 0 x 140000 1 1 0 1 … 1 0 1 1 … 0 1 Virtual Address 0 xb 6 a 57000 0 xb 6 a 58000 0 xb 6 a 59000 Page table Virtual Address Physical Address World 1 0 … Physical Address (binary) 0 x 100000 0 x 040000 0 x 080000 0 b 10000000000 0 b 001000000000 0 b 010000000000 1 1 0 0 0 1 … 1 0 Hello … (binary) 0 xb 6 a 57000 0 x 100000 0 b 10000000000 0 xb 6 a 58000 0 x 040000 0 b 001000000000 0 xb 6 a 59000 0 x 080000 0 b 010000000000 By modifying existing entries… or by adding new ones Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 79
Land sensitive data Phys Feng Shui (intuition) Physical memory Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 80
Land sensitive data Phys Feng Shui (intuition) Running applications before Drammer Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 81
Land sensitive data Phys Feng Shui (intuition) Step 1. Allocate large chunks of memory Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 82
Land sensitive data Phys Feng Shui (intuition) Step 2. Search for bit flips Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 83
Land sensitive data Phys Feng Shui (intuition) Step 2. Search for bit flips Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 84
Land sensitive data Phys Feng Shui (intuition) Step 2. Search for bit flips (got one!) Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 85
Land sensitive data Phys Feng Shui (intuition) Step 3. Allocate small chunks Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 86
Land sensitive data Phys Feng Shui (intuition) Step 3. Allocate small chunks Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 87
Land sensitive data Phys Feng Shui (intuition) Step 3. Allocate small chunks Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 88
Land sensitive data Phys Feng Shui (intuition) Step 4. Release vulnerable chunk Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 89
Land sensitive data Phys Feng Shui (intuition) Step 5. Generate a new page table Virtual Address Physical Address 0 xb 6 a 57000 0 xb 6 a 58000 0 xb 6 a 59000 0 x 100000 0 x 040000 0 x 080000 Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 90
Reproduce the bit flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 91
Reproduce the bit flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 92
Evaluation Device #flips 1 st exploitable flip after LG Nexus 51 1058 116 s LG Nexus 54 0 - LG Nexus 55 747, 013 1 s LG Nexus 4 1, 328 7 s One. Plus One 3, 981 942 s 429 441 s 117, 496 5 s Motorola Moto G (2013) LG G 4 (ARMv 8 – 64 -bit) Bit flips on 18 out of 27 tested devices Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 93
Evaluation Device #flips 1 st exploitable flip after LG Nexus 51 1058 116 s LG Nexus 54 0 - LG Nexus 55 747, 013 1 s LG Nexus 4 1, 328 7 s One. Plus One 3, 981 942 s 429 441 s 117, 496 5 s Motorola Moto G (2013) LG G 4 (ARMv 8 – 64 -bit) Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 94
Evaluation Device #flips 1 st exploitable flip after LG Nexus 51 1058 116 s LG Nexus 54 0 - LG Nexus 55 747, 013 1 s LG Nexus 4 1, 328 7 s One. Plus One 3, 981 942 s 429 441 s 117, 496 5 s Motorola Moto G (2013) LG G 4 (ARMv 8 – 64 -bit) Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 95
Evaluation Device #flips 1 st exploitable flip after LG Nexus 51 1058 116 s LG Nexus 54 0 - LG Nexus 55 747, 013 1 s LG Nexus 4 1, 328 7 s One. Plus One 3, 981 942 s 429 441 s 117, 496 5 s Motorola Moto G (2013) LG G 4 (ARMv 8 – 64 -bit) Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 96
Evaluation Device #flips 1 st exploitable flip after LG Nexus 51 1058 116 s LG Nexus 54 0 - LG Nexus 55 747, 013 1 s LG Nexus 4 1, 328 7 s One. Plus One 3, 981 942 s 429 441 s 117, 496 5 s Motorola Moto G (2013) LG G 4 (ARMv 8 – 64 -bit) After the 1 st exploitable flip, exploitation takes at most 22 seconds Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 97
Evaluation Device #flips 1 st exploitable flip after LG Nexus 51 1058 116 s LG Nexus 54 0 - LG Nexus 55 747, 013 1 s LG Nexus 4 1, 328 7 s One. Plus One 3, 981 942 s 429 441 s 117, 496 5 s Motorola Moto G (2013) LG G 4 (ARMv 8 – 64 -bit) After the 1 st exploitable flip, exploitation takes at most 22 seconds Drammer test app reported bit flips on: Google Pixel, One. Plus 3, Galaxy Note 7, … Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 98
Disclosure Contacted Google with suggested mitigations on July 25, 2016 (91 days before #CCS 16) “Can you publish at another conference, later this year? ” “What if we support you financially? ” Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 99
Disclosure Contacted Google with suggested mitigations on July 25, 2016 (91 days before #CCS 16) “Ok, could you then perhaps obfuscate some parts of the paper? ” Rewarded $4000 Partial hardening in November’s updates “We will continue to work on a longer term solution” Flip Feng Shui @ Surf – February 9, 2017 Scenario 3: Breaking the Mobile 100
CONCLUSION Now what? Flip Feng Shui @ Surf – February 9, 2017 Conclusion 101
Flip Feng Shui Deterministic Rowhammer exploitation by VUSec • We break your cloud • We break your browser • We break your mobile Yes, we are also working on software defenses… Software was never designed to deal with bit flips • Software defenses are in early stages and easily bypassed • Even hardware mitigations are currently still optional You cannot fix Rowhammer Flip Feng Shui @ Surf – February 9, 2017 Conclusion 102
Implications Rowhammer, the silent killer since 2010 • A lot of DRAM chips have been manufactured since • With 83% affected DDR 3 modules, this is a widespread issue • More research is necessary to understand the impact Rowhammer is not going away • Bit flips reported on both DDR 4 and the latest smartphones What is next? • Do you still trust hardware? • Will there be a Rowhammer 2. 0? Flip Feng Shui @ Surf – February 9, 2017 Conclusion 103
More details, demos, statistics, and Drammer test app https: //vusec. net/projects @vvdveen Flip Feng Shui @ Surf – February 9, 2017 @gober Conclusion 104
BACKUP SLIDES Did you not have enough yet? Flip Feng Shui @ Surf – February 9, 2017 Backup 105
Rowhammer A DRAM hardware glitch Memory cells (capacitors) have a natural discharge rate refresh every 64 ms Activating neighboring cells increases the discharge rate Rowhammer • Victim cell is charged to represent 1 • Neighboring cells are accessed frequently • Victim cell leaks charge below a certain threshold • When read, victim cell is interpreted 0 Disturbance error! Flip Feng Shui @ Surf – February 9, 2017 Backup 106
Memory templating Select the aggressor rows Dedicated hardware devices might be stupid • Simple devices cannot translate virtual to physical mappings • Shared memory must be contiguous DMA can behave very much like Huge Pages buf = gralloc(…) 0 xbff 00000 0 x 040000 0 xbff 40000 0 x 080000 0 xbff 80000 0 x 0 c 0000 0 xbffc 0000 0 x 100000 0 xc 0000000 0 x 140000 Flip Feng Shui @ Surf – February 9, 2017 Backup 1 1 0 1 … 1 0 1 1 … 0 1 1 0 … 1 1 0 1 … 0 0 1 0 … 107
Select the Aggressor Rows • DRAM works with physical memory addresses • Software works with virtual addresses • Unpredictable mapping of virtual to physical addresses • How do we select the addresses to read from? buf = malloc(…) 0 xbff 00000 0 x 040000 0 xbff 40000 0 x 080000 0 xbff 80000 0 x 0 c 0000 0 xbffc 0000 0 x 100000 0 xc 0000000 0 x 140000 Flip Feng Shui @ Surf – February 9, 2017 Backup 1 1 0 1 … 1 0 1 1 … 0 1 1 0 … 1 1 0 1 … 0 0 1 0 … 108
Select the Aggressor Rows • DRAM works with physical memory addresses • Software works with virtual addresses • Unpredictable mapping of virtual to physical addresses • How do we select the addresses to read from? buf = malloc(…) 0 xbff 00000 0 x 040000 0 xbff 40000 0 x 080000 0 xbff 80000 0 x 0 c 0000 0 xbffc 0000 0 x 100000 0 xc 0000000 0 x 140000 Flip Feng Shui @ Surf – February 9, 2017 Backup 1 1 0 1 … 1 0 1 1 … 0 1 1 0 … 1 1 0 1 … 0 0 1 0 … 109
Select the Aggressor Rows Solution: single sided Rowhammer Pick any two addresses and ‘just’ hammer • Less interference between rows, so less bit flips • Still good enough with buggy DRAM buf = malloc(…) 0 xbff 00000 0 x 040000 0 xbff 40000 0 x 080000 0 xbff 80000 0 x 0 c 0000 0 xbffc 0000 0 x 100000 0 xc 0000000 0 x 140000 Flip Feng Shui @ Surf – February 9, 2017 Backup 1 1 0 1 … 1 0 1 1 … 0 1 1 0 … 1 1 0 1 … 0 0 1 0 … 110
Select the Aggressor Rows Solution: pagemap Special file that holds the mapping of virtual to physical addresses /proc/self/pagemap buf = malloc(…) 0 xbff 00000 0 x 040000 0 xbff 40000 0 x 080000 0 xbff 80000 0 x 0 c 0000 0 xbffc 0000 0 x 100000 0 xc 0000000 0 x 140000 Flip Feng Shui @ Surf – February 9, 2017 Backup 1 1 0 1 … 1 0 1 1 … 0 1 1 0 … 1 1 0 1 … 0 0 1 0 … 111
Select the Aggressor Rows Solution: pagemap Special file that holds the mapping of virtual to physical addresses Solution: huge pages Virtual allocations mapped to physically contiguous memory buf = malloc(…) 0 xbff 00000 0 x 040000 0 xbff 40000 0 x 080000 0 xbff 80000 0 x 0 c 0000 0 xbffc 0000 0 x 100000 0 xc 0000000 0 x 140000 Flip Feng Shui @ Surf – February 9, 2017 Backup 1 1 0 1 … 1 0 1 1 … 0 1 1 0 … 1 1 0 1 … 0 0 1 0 … 112
