Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×

Submission + - New cloud attack takes full control of virtual machines with little effort (

C3ntaur writes: From Ars Technica,

The world has seen the most unsettling attack yet resulting from the so-called Rowhammer exploit, which flips individual bits in computer memory. It's a technique that's so surgical and controlled that it allows one machine to effectively steal the cryptographic keys of another machine hosted in the same cloud environment.

Until now, Rowhammer has been a somewhat clumsy and unpredictable attack tool because it was hard to control exactly where data-corrupting bit flips happened. While previous research demonstrated that it could be used to elevate user privileges and break security sandboxes, most people studying Rowhammer said there was little immediate danger of it being exploited maliciously to hijack the security of computers that use vulnerable chips. The odds of crucial data being stored in a susceptible memory location made such hacks largely a matter of chance that was stacked against the attacker. In effect, Rowhammer was more a glitch than an exploit.

Now, computer scientists have developed a significantly more refined Rowhammer technique they call Flip Feng Shui. It manipulates deduplication operations that many cloud hosts use to save memory resources by sharing identical chunks of data used by two or more virtual machines. Just as traditional Feng Shui aims to create alignment or harmony in a home or office, Flip Feng Shui can massage physical memory in a way that causes crypto keys and other sensitive data to be stored in locations known to be susceptible to Rowhammer.

Comment Not *really* selling student loans (Score 3, Insightful) 49

Sounds to me like they want to *write* student loans. Which is quite different from selling them. I would be interested in buying the notes, if that's what they were selling. Usurious interest rates, no chance of discharge in bankruptcy, no expiration. This is the kind of investment vehicle I would want to own.

Comment Re:The Cloud (Score 1) 446

The government already has all that, they don't need to break into DropBox or OneDrive to read that stuff.

True, and the government is not my main concern with putting sensitive data, albeit encrypted, in the cloud. My main concern is that someday, the encryption might be broken. Once that happens any script kiddie with the right tools can to get to the data, and there's no sure way to remove it from the cloud.

Comment Re:The Cloud (Score 2) 446

you will be at no risk of hackers or anyone else gaining access that way

I disagree. Encryption algorithms are constantly being tested and broken, and there is great incentive for that to continue. From the NSA and other governmental entities deliberately weakening the tools we use to encrypt, to as-yet undiscovered flaws, nobody can say with 100% certainty that current encryption technology will forever be secure.

And that's the biggest problem with the cloud. Once a single copy has been posted, you no longer have a sure way to delete every copy in existence.

Comment Re:Or they'll just implement censorship. (Score 1) 308

That is essentially what all ISPs want when they say they want to sell "fast lanes" on the internet. It's censorship. I'm just saying, give them what they want and then hold them criminally liable for anything illegal that gets through: pirated material, objectionable content, etc. No filter is perfect, and when the execs start landing in prison they'll change their tune soon enough.

Comment We can end this nonsense today. (Score 4, Interesting) 308

Seems to me that if ISPs want to selectively favor content, they should be held responsible for *any* content passing through their systems. Start throwing their execs in prison for distributing whatever illegal material passes through, and watch how fast they scramble to be classified as common carriers.

Slashdot Top Deals

grep me no patterns and I'll tell you no lines.