This retrospective paper describes the RowHammer problem in dynamic random access memory (DRAM), which was initially introduced by Kim et al. at the ISCA 2014 Conference. RowHammer is a prime (and perhaps the first) example of how a circuit-level failure mechanism can cause a practical and widespread system security vulnerability. It is the phenomenon that repeatedly accessing a row in a modern DRAM chip causes bit flips in physically adjacent rows at consistently predictable bit locations. RowHammer is caused by a hardware failure mechanism called DRAM disturbance errors , which is a manifestation of circuit-level cell-to-cell interference in a scaled memory technology. Researchers from Google Project Zero demonstrated in 2015 that this hardware failure mechanism can be effectively exploited by user-level programs to gain kernel privileges on real systems. Many other follow-up works demonstrated other practical attacks exploiting RowHammer. In this paper, we comprehensively survey the scientific literature on RowHammer-based attacks as well as mitigation techniques to prevent RowHammer. We also discuss what other related vulnerabilities may be lurking in DRAM and other types of memories, e.g., NAND flash memory or phase change memory, that can potentially threaten the foundations of secure systems, as the memory technologies scale to higher densities. We conclude by describing and advocating a principled approach to memory reliability and security research that can enable us to better anticipate and prevent such vulnerabilities.

RowHammer: A Retrospective

It is an accepted fact that, as the years go by, technology rapidly evolves. For this reason, it is absolutely necessary to constantly watch its evolution, to search for new ways for its progression, adjusting to the new conditions and demands. This effort can be mainly fulfilled by computers. Computers allow us to comprehend the development of technology, assisted by the growing development of the tool-programs that can be used. Another fundamental stepping stone for the technological evolution is the electrical machines which replace manual labor, since they are faster, more precise, and dependable. On a long term, using the electrical machines decreases the cost, whereas manual labor loses its prestige as the years go by. The present project extensively discusses the Raspberry Pi, one of the most sophisticated pocket computer models, which is able to conduct more complex implementations than the rest of the available models, using more program languages. More specifically, in the 1st chapter, we will make a small introduction about the Raspberry Pi, mentioning its definition and its history, referring to the date of the release of each model and some details about each one of them. We will, also, discuss the differentiations of each model and, this very chapter will make us understand what we can do with each one of the models.
In the 2nd chapter, we will refer to the raspberry hardware. First of all, the pins of the Raspberry Pi will be introduced and analyzed. The attachments needed for the activation of the Raspberry Pi will be mentioned and the right steps for the installation of the NOOBS operating system to the SD Card will be studied. Moreover, the RASPBIAN operating system will be installed to the Raspberry Pi 3. Finally, the first steps that we need to make once the Raspberry Pi turns on will be mentioned. In the 3rd chapter we will talk about the SSH. We will closely take a look at the steps needed in order to install the RASPBIAN operating system to the SD Card. We will see what the SSH is, as well.
In the 4th chapter, we will study the examples where the micro-controller is used, the attachments needed for each project, and we will analyze the circuits for each of the examples. We will be citing the circuit through the FRITZING and we will be discussing the code of each example so that the application can function. The examples will be of a gradual difficulty. The present dissertation aims to inform the students about an innovative micro-controller; the Raspberry Pi 3 Model B. The truth is that only few people are aware of this micro-controller. For this reason, our goal is to make the micro-controller more comprehensive to you.

Οδηγός για το Raspberry Pi 3 Model B

After a plethora of high-profile RowHammer attacks, CPU and DRAM vendors scrambled to deliver what was meant to be the definitive hardware solution against the RowHammer problem: Target Row Refresh (TRR). A common belief among practitioners is that, for the latest generation of DDR4 systems that are protected by TRR, RowHammer is no longer an issue in practice. However, in reality, very little is known about TRR. How does TRR exactly prevent RowHammer? Which parts of a system are responsible for operating the TRR mechanism? Does TRR completely solve the RowHammer problem or does it have weaknesses? In this paper, we demystify the inner workings of TRR and debunk its security guarantees. We show that what is advertised as a single mitigation mechanism is actually a series of different solutions coalesced under the umbrella term Target Row Refresh. We inspect and disclose, via a deep analysis, different existing TRR solutions and demonstrate that modern implementations operate entirely inside DRAM chips. Despite the difficulties of analyzing in-DRAM mitigations, we describe novel techniques for gaining insights into the operation of these mitigation mechanisms. These insights allow us to build TRRespass, a scalable black-box RowHammer fuzzer that we evaluate on 42 recent DDR4 modules. TRRespass shows that even the latest generation DDR4 chips with in-DRAM TRR, immune to all known RowHammer attacks, are often still vulnerable to new TRR-aware variants of RowHammer that we develop. In particular, TRRespass finds that, on present-day DDR4 modules, RowHammer is still possible when many aggressor rows are used (as many as 19 in some cases), with a method we generally refer to as Many-sided RowHammer. Overall, our analysis shows that 13 out of the 42 modules from all three major DRAM vendors (i.e., Samsung, Micron, and Hynix) are vulnerable to our TRR-aware RowHammer access patterns, and thus one can still mount existing state-of-the-art system-level RowHammer attacks. In addition to DDR4, we also experiment with LPDDR4(X)1 chips and show that they are susceptible to RowHammer bit flips too. Our results provide concrete evidence that the pursuit of better RowHammer mitigations must continue.

/pdf/trrespass-exploiting-the-many-sides-of-target-row-refresh-1tv29bvn26.pdf

TRRespass: Exploiting the Many Sides of Target Row Refresh

The Rowhammer bug is a reliability issue in DRAM cells that can enable an unprivileged adversary to flip the values of bits in neighboring rows on the memory module. Previous work has exploited this for various types of fault attacks across security boundaries, where the attacker flips inaccessible bits, often resulting in privilege escalation. It is widely assumed however, that bit flips within the adversary’s own private memory have no security implications, as the attacker can already modify its private memory via regular write operations.We demonstrate that this assumption is incorrect, by employing Rowhammer as a read side channel. More specifically, we show how an unprivileged attacker can exploit the data dependence between Rowhammer induced bit flips and the bits in nearby rows to deduce these bits, including values belonging to other processes and the kernel. Thus, the primary contribution of this work is to show that Rowhammer is a threat to not only integrity, but to confidentiality as well.Furthermore, in contrast to Rowhammer write side channels, which require persistent bit flips, our read channel succeeds even when ECC memory detects and corrects every bit flip. Thus, we demonstrate the first security implication of successfully-corrected bit flips, which were previously considered benign.To demonstrate the implications of this read side channel, we present an end-to-end attack on OpenSSH 7.9 that extracts an RSA-2048 key from the root level SSH daemon. To accomplish this, we develop novel techniques for massaging memory from user space into an exploitable state, and use the DRAM rowbuffer timing side channel to locate physically contiguous memory necessary for double-sided Rowhammering. Unlike previous Rowhammer attacks, our attack does not require the use of huge pages, and it works on Ubuntu Linux under its default configuration settings.

/pdf/rambleed-reading-bits-in-memory-without-accessing-them-40xybjg4lf.pdf

RAMBleed: Reading Bits in Memory Without Accessing Them

Modern computing systems are overwhelmingly designed to move data to computation. This design choice goes directly against at least three key trends in computing that cause performance, scalability and energy bottlenecks: (1) data access is a key bottleneck as many important applications are increasingly data-intensive, and memory bandwidth and energy do not scale well, (2) energy consumption is a key limiter in almost all computing platforms, especially server and mobile systems, (3) data movement, especially off-chip to on-chip, is very expensive in terms of bandwidth, energy and latency, much more so than computation. These trends are especially severely-felt in the data-intensive server and energy-constrained mobile systems of today. At the same time, conventional memory technology is facing many technology scaling challenges in terms of reliability, energy, and performance. As a result, memory system architects are open to organizing memory in different ways and making it more intelligent, at the expense of higher cost. The emergence of 3D-stacked memory plus logic, the adoption of error correcting codes inside the latest DRAM chips, proliferation of different main memory standards and chips, specialized for different purposes (e.g., graphics, low-power, high bandwidth, low latency), and the necessity of designing new solutions to serious reliability and security issues, such as the RowHammer phenomenon, are an evidence of this trend. This chapter discusses recent research that aims to practically enable computation close to data, an approach we call processing-in-memory (PIM). PIM places computation mechanisms in or near where the data is stored (i.e., inside the memory chips, in the logic layer of 3D-stacked memory, or in the memory controllers), so that data movement between the computation units and memory is reduced or eliminated.

A Modern Primer on Processing in Memory.

A fundamental assumption in software security is that memory contents do not change unless there is a legitimate deliberate modification. Classical fault attacks show that this assumption does not hold if the attacker has physical access. Rowhammer attacks showed that local code execution is already sufficient to break this assumption. Rowhammer exploits parasitic effects in DRAM to modify the content of a memory cell without accessing it. Instead, other memory locations are accessed at a high frequency. All Rowhammer attacks so far were local attacks, running either in a scripted language or native code. In this paper, we present Nethammer. Nethammer is the first truly remote Rowhammer attack, without a single attacker-controlled line of code on the targeted system. Systems that use uncached memory or flush instructions while handling network requests, e.g., for interaction with the network device, can be attacked using Nethammer. Other systems can still be attacked if they are protected with quality-of-service techniques like Intel CAT. We demonstrate that the frequency of the cache misses is in all three cases high enough to induce bit flips. We evaluated different bit flip scenarios. Depending on the location, the bit flip compromises either the security and integrity of the system and the data of its users, or it can leave persistent damage on the system, i.e., persistent denial of service. We investigated Nethammer on personal computers, servers, and mobile phones. Nethammer is a security landslide, making the formerly local attack a remote attack.

Nethammer: Inducing Rowhammer Faults through Network Requests

In this paper, we present Nethammer, a remote Rowhammer attack without a single attacker-controlled line of code on the targeted system, i.e., not even JavaScript. Nethammer works on commodity consumer-grade systems that either are protected with quality-of-service techniques like Intel CAT or that use uncached memory, flush instructions, or non-temporal instructions while handling network requests (e.g., for interaction with the network device). We demonstrate that the frequency of the cache misses is in all three cases high enough to induce bit flips. Our evaluation showed that depending on the location, the bit flip compromises either the security and integrity of the system and the data of its users, or it can leave persistent damage on the system, i.e., persistent denial of service. We invalidate threat models of Rowhammer defenses building upon the assumption of a local attacker. Consequently, we show that most state-of-the-art defenses do not affect our attack. In particular, we demonstrate that target-row-refresh (TRR) implemented in DDR4 has no aggravating effect on local or remote Rowhammer attacks.

Response to SARS-CoV-2-vaccines in kidney-transplant recipients (KTR) is severely reduced. Heterologous3rd vaccination combining mRNA and vector vaccines did not increase seroconversion at 4 weeks after vaccination, but evolution of antibody levels beyond the first month remains unknown. We have recently completed a randomized-controlled trial on heterologous (Ad26COVS1) vs. homologous (BNT162b2 or mRNA-1273) 3rd vaccination in 201 KTR not developing SARS-CoV-2-spike-protein antibodies following two doses of mRNA vaccine (EurdraCT: 2021-002927-39). Here, we report seroconversion at the second follow-up at 3 months after the 3rd vaccination (prespecified secondary endpoint). In addition, higher cut-off levels associated with neutralizing capacity and protective immunity were applied (i.e., > 15, > 100, > 141, and > 264 BAU/ml). A total of 169 patients were available for the 3-month follow-up. Overall, seroconversion at 3 months was similar between both groups (45 vs. 50% for mRNA and the vector group, respectively; p = 0.539). However, when applying higher cut-off levels, a significantly larger number of individuals in the vector group reached antibody levels > 141 and > 264 BAU/ml at the 3-month follow-up (141 BAU/ml: 4 vs. 15%, p = 0.009 and 264 BAU/ml: 1 vs. 10%, p = 0.018 for mRNA vs. the vector vaccine group, respectively). In line, antibody levels in seroconverted patients further increased from month 1 to month 3 in the vector group while remaining unchanged in the mRNA group (median increase: mRNA = 1.35 U/ml and vector = 27.6 U/ml, p = 0.004). Despite a similar overall seroconversion rate at 3 months following 3rd vaccination in KTR, a heterologous 3rd booster vaccination with Ad26COVS1 resulted in significantly higher antibody levels in responders.

/pdf/three-month-follow-up-of-heterologous-vs-homologous-third-23c6nrkh.pdf

Three-Month Follow-Up of Heterologous vs. Homologous Third SARS-CoV-2 Vaccination in Kidney Transplant Recipients: Secondary Analysis of a Randomized Controlled Trial

[This corrects the article DOI: 10.3389/fmed.2022.936126.].

/pdf/corrigendum-three-month-follow-up-of-heterologous-vs-16b2khhl.pdf

Corrigendum: Three-Month follow-up of heterologous vs. homologous third SARS-CoV-2 vaccination in kidney transplant recipients: Secondary analysis of a randomized controlled trial

Lukas Raab

Papers

Nethammer: Inducing Rowhammer Faults through Network Requests

Nethammer: Inducing Rowhammer Faults through Network Requests

Three-Month Follow-Up of Heterologous vs. Homologous Third SARS-CoV-2 Vaccination in Kidney Transplant Recipients: Secondary Analysis of a Randomized Controlled Trial

Corrigendum: Three-Month follow-up of heterologous vs. homologous third SARS-CoV-2 vaccination in kidney transplant recipients: Secondary analysis of a randomized controlled trial