Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus.

Can linux inherently detect an attacker connecting to the ram bus in that way?

If not, is there any open source software with this capability?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

This got cross-posted to electronics.stackexchange. The short answer is that it's not possible to detect all of this kind of hostile hardware attack in software.

If you had a probing device on the bus that actively requested memory reads, it would be possible to detect it by observing delays in memory reads. You'd have to specifically go looking for it by setting up an uncached read with timing measurements before and after, but you could detect it.

However, if I were building this sort of attack system I'd simply have a shadow dual port RAM connected to the same write lines, storing a copy of all memory access since bootup. I could then read from the copy without disrupting timing of the main memory access. It's not trivial to build such a thing - it requires careful attention to avoid disrupting the electrical signals to the RAM - but it's quite feasible against socketed or soldered DRAM. It's not feasible against internal RAM of a SoC, or stacked chip RAM such as in the Raspberry Pi.

(This is not to be confused with "cache snooping", which is a normal part of a multiprocessor system)

Edit in response to comment: it's not especially different on a multiprocessor system; on a NUMA system you need one snooping probe per memory bus. It's certainly something that requires a lot of effort and physical access, so it's mostly used for breaking into devices that you own such as games consoles and mobile phones. It's not something I'd expect to see in a datacenter; high-value target machines are likely to be locked away in tamper-alarmed cases to defend against this kind of thing.

(References? Does this SE have a Wikipedia-style ban on original research?)

share|improve this answer
    
Can you please provided cited references? –  AbsoluteƵERØ May 30 '13 at 17:21
    
Also if he's looking for security related issues having the machine down to install this type of system would show up in the logs much more noticeably than a kernel panic. How would you implement this on hyper-threaded systems with multiple processors? –  AbsoluteƵERØ May 30 '13 at 17:54
    
I've not seen a ban on non-cited references. I was simply curious if you have something where someone has done this in practice. Am interested in the hardware engineering (specifically wiring). I was looking at the question from an IT security standpoint (not thinking about cell phones). If they had physical access and did the phreak themselves they would likely know what to look for in regard to noticing a change in "system" behavior. I thought the OP was talking about noticing someone else's modification. –  AbsoluteƵERØ May 30 '13 at 18:34
    
Wiring is going to be the difficult part; it's easy enough to solder a bunch of wires from the DRAM to your device, but the extra wire will change the characteristic impedance of the system and may introduce reflections or otherwise distort the normal signal to the DRAM. The wire should be short, of equal length, and either shielded or parallel to a ground plane. –  pjc50 May 30 '13 at 18:50
    
(As you say in your other answer, if you have physical access to a PCI bus you can just add a malicious PCI device and copy any region of RAM you like with DMA) –  pjc50 May 30 '13 at 18:55
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.