Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I wonder how long before someone demonstrates fault attacks triggered from a sandbox in the cloud..

I imagine something like rowhammer could be used..



This attack uses physical fault injection, so it shouldn't be trivial for remote attackers to use it, but it definitely is a nice demonstration, and exposes vulnerabilities on chips that generate and store such keys, like maybe pay-tv cards (remember the business of Kudekski/Nagra).


Just a while ago there was a paper here about how to create faults using the CPU's power management features, by software.


Sure, and Rowhammer flips bits from software too. The point here is you need relatively precise control not just in location but in timing of your bit flips to break crypto like this. Rowhammer attackers have the luxury of attacking bits that stay high-value for long periods of time. DFA attackers get very tiny windows.


Not very long. Flip Feng Shui does exactly that: a malicious program in a VM can affect another one co-hosted in the same cloud server if the hypervisor uses deduplication:

https://www.vusec.net/projects/flip-feng-shui/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: