Linkstrain-ng Slideshow

Rowhammer attacks exploit electromagnetic interference among nearby DRAM cells to flip bits, corrupting data and altering system behavior. Unfortunately, DRAM vendors have opted for a blackbox approach to preventing these bit flips, exposing little information about in-DRAM mitigations. Despite vendor claims that their mitigations prevent Rowhammer, recent work bypasses these defenses to corrupt data. Further work shows that the Rowhammer problem is actually worsening in emerging DRAM and posits that system-level support is needed to produce adaptable and scalable defenses. Accordingly, we argue that the systems community can and must drive a fundamental change in Rowhammer mitigation techniques. In the short term, cloud providers and CPU vendors must work together to supplement limited in-DRAM mitigations—ill-equipped to handle rising susceptibility— with their own mitigations. We propose novel hardware primitives in the CPU’s integrated memory controller that would enable a variety of efficient software defenses, offering flexible safeguards against future attacks. In the long term, we assert that major consumers of DRAM must persuade DRAM vendors to provide precise information on their defenses, limitations, and necessary supplemental solutions. Comments

...more

There's a vulnerability in Wi-Fi hardware that breaks the encryption: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, and Wi-Fi routers from Asus and Huawei, as well as the Raspberry Pi 3. Eset, the security...

...more

Summary: Thangrycat is caused by a series of hardware design flaws within Cisco's Trust Anchor module. First commercially introduced in 2013, Cisco Trust Anchor module (TAm) is a proprietary hardware security module used in a wide range of Cisco products, including enterprise routers, switches and firewalls. TAm is the root of trust that underpins all other Cisco security and trustworthy...

...more

This sounds like a good development: ...a new $10 million contract the Defense Department's Defense Advanced Research Projects Agency (DARPA) has launched to design and build a secure voting system that it hopes will be impervious to hacking. The first-of-its-kind system will be designed by an Oregon-based firm called Galois, a longtime government contractor with experience in designing secure and...

...more

Summary

Unpatchable vulnerability in Apple chip leaks secret encryption keys

How I built a fully offline smart home, and why you should too

Intel Microcode Decryptor

SATAn: Air-Gap Exfiltration Attack via Radio Signals From SATA Cables

🤖: "SATA hack ðŸ“ŠðŸ’»"

Telenot Complex: Insecure AES Key Generation

Stop! Hammer Time: Rethinking Our Approach to Rowhammer Mitigations

🤖: "Hammer time smash"

Smart male chastity lock cock-up

A mysterious bug in the firmware of Google's Titan M chip (CVE-2019-9465)

🤖: "BuggedTitan"

Wi-Fi Chip Vulnerability

🤖: ""Hack alert""

Thangrycat: A Serious Cisco Vulnerability

🤖: "pwned ðŸ’»"

DARPA Is Developing an Open-Source Voting System

🤖: "Election hack proof?"

end