Flip Feng Shui: Hammering a Needle in the Software Stack

By Kaveh Razavi, Ben Gras, Erik Bosman, Bart Preneel, Cristiano Giuffrida, Herbert Bos. USENIX Security Symposium, 2016

317 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/f0e0fdaff62992e9145af5f492443f99c6773d04

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Retrospective: Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors (2023, unknown): “…adjacent row can be modeled as a random variable X that is binomially-distributed with parameters B(N th , (cid:49)(cid:56) Several patent applications propose to maintain an array of counters (“detection logic”) in either the memory controller [7, 8, 24] or in the DRAM chips themselves [6, 9, 23].”
CodedPrivateML: A Fast and Privacy-Preserving Framework for Distributed Machine Learning (2019, background): “For instance, it has been shown that adversarial users can compromise the host machines by disguising themselves as regular users, and access the information of other users sharing the same host machines [2]–[7].”
Processing Data Where It Makes Sense: Enabling In-Memory Computation (2019, background): “Other researchers have shown how RowHammer vulnerabilities can be exploited in various ways to gain privileged access to various systems: in a remote server RowHammer can be used to remotely take over the server via the use of JavaScript [128]; a virtual machine can take over another virtual machine”
RowHammer: A Retrospective (2019, background): “One involves the takeover of a victim VM by another attacker VM running on the same system [205].”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, background): “[27] have shown that the Rowhammer attack is possible in crossVM settings by attacking Xen paravirtual memory management or exploiting memory deduplication, respectively.”
TRRespass: Exploiting the Many Sides of Target Row Refresh (2020, methodology): “For this purpose, we show how we craft many-sided RowHammer exploits using the general RowHammer exploitation framework used by prior work in the area [79].”
Another Flip in the Wall of Rowhammer Defenses (2017, background): “Other ad-hoc attempts, such as disabling page deduplication by default [52, 60], only prevent specific Rowhammer attacks exploiting these features [11, 59], but not all Rowhammer attacks.”
RIDL: Rogue In-Flight Data Load (2019, background): “This discloses the physical addresses of pages in our own process, which is important information to mount other attacks (such as Rowhammer attacks [51], [52], [53], [54], [55], [56], [57], [58], [59]).”
Backdoor Learning: A Survey (2020, background): “flipping in main memory by adopting row-hammer attack [75].”
Drammer: Deterministic Rowhammer Attacks on Mobile Platforms (2016, methodology): “Such features are often unavailable on commodity platforms (e.g., all are unavailable on the popular Amazon EC2 cloud, despite recent work explicitly targeting a cloud setting [32,47]) or disabled for security reasons [40,46].”
CLKSCREW: Exposing the Perils of Security-Oblivious Energy Management (2017, background): “Since then, many works use the Rowhammer issue to demonstrate the dangers of such softwareinduced hardware-based transient bit-flips in practical scenarios ranging from browsers [30], virtualized environments [50], privilege escalation on Linux kernel [52] and from Android apps [57].”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “The literature has also seen attempts to fool deep neural networks by exploiting their storage on Dynamic Random Access Memory (DRAM) [173]–[175].”