DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
summary
Reverse engineers DRAM address maps with two methods: physical probing with an oscilloscope on chip‑select and bank pins and a fully automated timing-based software method that solves linear XOR functions. Uses the mappings to build a covert channel that reaches about 2.1 Mbps on a desktop and 1.2 Mbps cross‑CPU, a low‑noise side channel that detects keystrokes with spatial resolution down to ~512 bytes, and to make practical Rowhammer bit flips on DDR4. Source code and tools are published.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:40Setting - Cloud Servers
- 1:34Overview
- 2:13DRAM Organization
- 3:32DRAM Banks
- 3:56The Row Buffer
- 5:20Reverse-Engineering DRAM Addressing
- 6:16Approach 1: Probing the Memory Bus
- 7:26Approach 2: Fully Automated SW-based
- 10:54Some Results - Server System
- 11:31High-speed covert channel
- 11:42Concept
- 12:44Implementation
- 13:40Performance Comparison
- 14:25Low-noise side-channel attack
- 14:40Spying on Memory Accesses
- 16:06Example
- 17:44Countermeasures to DRAMA
- 19:15Improving Attacks - Rowhammer
related talks
28mComplexity Killed Security
40mRowhammer Attacks: A Walkthrough Guide
10mMcSee: Evaluating Advanced Rowhammer Attacks and Defenses via Automated...
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
38mCSI:Rowhammer: Closing the Case of Half-Double and Beyond
51mExploiting Hardware Glitches And Side Channels In Perfect Software
16mECC.fail: Mounting Rowhammer Attacks on DDR4 Servers with ECC Memory
14mGPUHammer: Rowhammer Attacks on GPU Memories are Practical