Skip to content

Comment on New DNS hijacking technique exploits RAM errors

Comments

This seems pretty unlikely with ECC modules. Worst reported error rate for regular RAM was 1 bit per hour per GB (via wikipedia) while other reports claim it'd take a century for that same amount of error.

Regardless, this is ever more reason to use something like TLS to initiate a trusted identity with another party. Even in the null cipher case, it's useful to exchange a certificate.

Sections 7 and 8 of this paper [1] discuss inducing memory faults and potential countermeasures. Specifically they indicate that many desktop PCs shipped without ECC hardware at the time of writing (2003). I'm not sure to what extent that's still true, but I imagine it could be a problem for the masses of cheap/old hardware in use around the world.

edit: I found some more recent numbers via [2]. Relevant quote: "Our first observation is that memory errors are not rare events. About a third of all machines in the fleet experience at least one memory error per year (see column CE Incid. %) and the average number of correctable errors per year is over 22,000. These numbers vary across platforms, with some platforms (e.g. Platform A and B) seeing nearly 50% of their machines affected by correctable errors, while in others only 12–27% are affected. The median number of errors per year for those machines that experience at least one error ranges from 25 to 611." They were using server-class machines with ECC.

[1] http://sip.cs.princeton.edu/pub/memerr.pdf

[2] http://www.cs.toronto.edu/~bianca/papers/sigmetrics09.pdf

Desktop machines still do not ship with ECC, other than a few high end ones that use server hardware.

Even with regular non-ECC modules, it seems like the odds of this affecting you are very very low.

But the sheer number of operational computers probably means that the likelihood that at any given moment this is impacting someone's DNS query is probably fairly high.

True but vulnerabilities are only as viable as they are economical to execute. The effort isn't very high but the yield is proportionately low as well.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.