Tag Info

New answers tagged

4

The risk/issue is exactly the same and the mitigation as well. Regardless if it loads the database partially or completely into memory. There will be no way for you to tell which keys have been compromised and which haven't. So the only option would be to revoke them all, regardless if it's a Redis or SQL database. Most of the time the reason why people are ...


1

Google has an exploit called RowHammer which allows a user to read the contents of RAM that is adjacent to the data being written to. Encrypting the RAM would make this exploit much more difficult. “Rowhammer” is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. We tested a ...


5

The basic security implication is that an unprivileged user can elevate their access to root/kernel level. Google's Project Zero tested 29 different laptops manufactured between 2010-2014 inclusive, and found that 15 were vulnerable and 14 were not. They do warn that this sample size is not enough to be considered representative, but it is still suggestive ...


3

ECC RAM is not necessarily immune; ECC memory reliably fix one-bit flips and detect most two-bit flips, which makes the attack harder, but not conceptually infeasible. Non-ECC RAM is not necessarily weak; in fact, as per the definition of how RAM should behave, no single bit flip should ever happen. What we are talking here is RAM with a defect: the RAM ...


1

Technically feasible? Certainly. It doesn't sound different from any other live CD, just with a server-oriented environment rather than the more traditional desktop-oriented one. What advantages do you picture this having, though?



Top 50 recent answers are included