Hacker News new | past | comments | ask | show | jobs | submit login

Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive.

Allow me to save some time, from TFA:

> Is there a CVE number?

> Yes, see CVE-2019-0174 [1].

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0174


> What is RAMBleed?

> Previous attacks exploited the Rowhammer effect to write (or flip) bits in the victim's memory. RAMBleed is different in that it uses Rowhammer for reading data stored inside the computer's physical memory. As the physical memory is shared among all process in the system, this puts all processes at risk.

> What data can be read by RAMBleed?

> While the end-to-end attack we demonstrated read out OpenSSH 7.9's RSA key, RAMBleed can potentially read any data stored in memory. In practice, what can be read depends on the victim program's memory access patterns.

> What technologies are affected by RAMBleed?

> RAMBleed relies on Rowhammer-induced bit flips to read privileged memory. As such, any system that uses Rowhammer-susceptible DIMMs is vulnerable. Previous research has demonstrated bit flips on both DDR3 and DDR4 with TRR (targeted row refresh) enabled. While we demonstrated our attack on a desktop machine and an ECC enabled server machine, Rowhammer attacks have been demonstrated against both mobile devices and laptops. As such, we suspect that many classes of computers are susceptible to RAMBleed.

> How can I mitigate this issue?

> Users can mitigate their risk by upgrading their memory to DDR4 with targeted row refresh (TRR) enabled. While Rowhammer-induced bit flips have been demonstrated on TRR, it is harder to accomplish in practice.

> Memory manufacturers can help mitigate this issue by more rigorously testing for faulty DIMMs. Furthermore, publicly documenting vendor specific TRR implementations will facilitate a stronger development process as security researchers probe such implementations for weaknesses.

Relevant @patio11 article


I think the marketing campaigns are awesome. Makes it much easier to get resources to fix.

Wow, that's a really excellent read. Thanks.

Unless your CEO loves talking about CVEs all day long, I think we should all be grateful for these good-looking marketing campaigns for serious security issues.

I whole-heartedly agree with your broader point about having sensible names and descriptions that draw necessary attention to critical flaws. (And "+1" to the excellent related article from patio11.)

But sometimes it seems to be stretched to the point of making you feel nauseated and cause extreme distraction (which can be the point in some cases, though). Still, I wish some of the less egregious issues were described with a little less hysteria, while still conveying their seriousness. (Maybe it's my weariness of dealing with them is speaking here.)

This really sux - that the fix is "Move to DDR with TRR enabled - which means for many people: Buy a new computer. Or new RAM. Or new RAM, motherboard, CPU, etc - ie - a new computer; ie - spend a lot of money".

But there really isn't any other good options.

They need to step up their marketing game. They don't even have a Twitter account to promote Rambleed. twitter.com/rambleed isn't taken yet ;-)

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact