If exploited, these flaws can allow attackers to gain unauthorized access to sensitive information or generally cause problems
Recently, a group of researchers from the University of California at Davis analyzed the possibility of using Rowhammer (the DRAM bit corruption method) to generate unique fingerprints.
During their analysis, they mentioned that they noticed the nature of the distortions resulting from the Rowhammer attack is unique to each instance of the DRAM chip and does not change over time. As a result, the Centauri technique was developed, which allows for the identification of systems with an average accuracy of 99,91%.
To generate an identifier in Centauri, simply run the code for a few seconds or minutes. At the cost of a slight decrease in accuracy (to 0,64), identification can be performed with a 95% reduction in time to around 9.92 seconds. The highest accuracy is achieved when the verification runs for about three minutes.
The identification process is carried out in three stages :
- Using the Blacksmith method (RowHammer variant) to determine the protection strategy (TRR) used in the chip against distortion of memory cells
- Code execution leading to distortions
- Determination of the relative position and number of capacitors that have changed the value of the charge.
The identifier is formed on the basis of constructing an empirical distribution of the probability of changing the charge of the capacitors in a 2-megabyte block of memory.
For those of you who are unaware of RowHammer class attacks, you should know that they allow you to distort the content of individual bits of memory by cyclically reading data from neighboring memory cells.
“Centauri is the first technique to demonstrate the extraction of unique and stable fingerprints on the largest scale using Rowhammer while overcoming the practical limitations imposed by the operating system and by Rowhammer mitigations like TRR”
Since DRAM is a two-dimensional array of cells, each consisting of a capacitor and a transistor, continuously reading the same area of memory results in voltage fluctuations and anomalies that cause a slight loss of charge. in neighboring cells. If the reading intensity is high, then the neighboring cell may lose a sufficiently large amount of charge and the next regeneration cycle will not have time to restore its original state, which will cause a change in the value of the data stored in the cell. .
The chip manufacturing process is heterogeneous, so each memory chip is unique in its physical structure due to the tolerances involved. These variations mean that the probability distribution of bit distortion caused by the Rowhammer attack is also unique for each manufactured memory module, which is what the creators of the Centauri method exploited.
The TRR (Target Row Refresh) mechanism used by memory manufacturers, which protects against Rowhammer attacks by blocking distortion of cells in adjacent rows, does not affect the accuracy of identification by the Centauri method.
In practical terms , the method can be used, for example, to detect equipment replacement or to identify systems in which a single computer masquerades as several different devices. However, it is unlikely to extend beyond the realm of academic research, as its use leads to increased wear on memory chips and can cause software malfunctions due to distortions in the cell contents.
It is not excluded that the method can be adapted to work in a browser to identify website visitors, using a pre-prepared implementation of Rowhammer in JavaScript as a basis.
The method has been tested on about 98 DRAM modules (6 identical chipsets from two manufacturers). Repeated experiments performed within 10 days did not reveal a decrease in identification accuracy.
Finally, if you are interested in learning more, you can find the details at the following link.