1

I read "Data Remanence in Semiconductor Devices" by Peter Gutmann, in which it is stated that it is possible to reconstruct the content of an erased SRAM based on changes of properties of the memory cells (thresholds, times).

Does this issue also apply to DDR2?

I use a laptop that contains a 2GB DDR2 module (PSD22G8002S), I always do a BIOS post test after working with sensitive data to overwrite them. In this case, is there any way to retrieve the deleted (overwritten) information?

Should I be worried about something like this?

Improve this question
12
  • In case of DDR2 the issue is worse. en.wikipedia.org/wiki/Cold_boot_attack See "TCG Platform Reset Attack Mitigation Specification" But I guess the DDR2 laptop does not use that. It also won't prevent putting the RAM into a different machine. Maybe consider buying a new device?
    – secfren
    Commented Nov 30, 2022 at 21:18
  • Thanks for the warning, as I say I use the BIOS POST memory test, everything is overwritten in a few seconds and in addition my laptop does not contain any graphics memory. As I said, I'm interested in the issue described by Professor Gutmann, or you can explain to me what man-in-the-RAM attack means, because I'm hearing this for the first time and they don't write anything about it anywhere on Google.
    – Hasbo
    Commented Dec 1, 2022 at 1:09
  • What issue? The wikipedia link mentions a relevant attack. What is your threat model?Someone dumping memory? Someone taking your memory modules and putting them into a different computer? Where is man-in-the-RAM attack mentioned?
    – secfren
    Commented Dec 1, 2022 at 9:57
  • @secfren man-in-the-RAM is mentioned at the end of Secure erasure of memory section, in the wiki link... i realy dont understand what they mean by this?
    – Hasbo
    Commented Dec 1, 2022 at 14:44
  • My threat model is that someone will take the Ram module from my PC and perform an analysis of the properties of the memory cells, possibly microscopy (but microscopy might be not possible). Based on the divergenceies of voltage thresholds and timings, an attacker could estimate the previous stored value in the cell, even before the value (0,1) was overwritten. With SRAM, these divergencies arise due to "Hot electrons". The question remains for me, does this also happen in much modern, compared to Sram, DDR2 under normal circumstances?
    – Hasbo
    Commented Dec 1, 2022 at 14:52

2 Answers 2

Reset to default
0

If I understand the question correctly, you're asking if it's possible to retrieve the contents of a DRAM cell after it is overwritten with new data, but while the system is still powered on.

There is no way to obtain the previous state of a DRAM cell after it has been overwritten. DRAM is dynamic, which means that each memory cell is refreshed regularly. As soon as you write new data to a memory location, you haven't just overwritten the data once. You're actively overwriting it again and again every 64 milliseconds. Whatever used to be there is long, long gone.

Note that it might be possible to use a rowhammer-like attack rapidly reading rows of memory to trigger hot-carrier injection that could damage nearby rows and increase their sensitivity to future rowhammer attacks. In theory, an attacker might be able to watermark memory by damaging it selectively in this way. Recovery of the watermarked data could be done by performing another rowhammer attack and determining which addresses are now more sensitive to rowhammer.

Improve this answer
24
  • if we, for example, overwrote value "1111" by value "1111", the positive charge might not be released, so if we immediately , in couple minutes, write 0 into the cell and measure the voltage or time of that cell, we would find a divergency, based on which we could assume that the value previously stored was "1". Under normal operating conditions, however, the cell is only slightly stressed, so in my opinion there should be no divergencies, at least not significant enough to be able to measure them in a short period of time, like 2 minutes, and woud not occur in significant extent.
    – Hasbo
    Commented Dec 3, 2022 at 4:21
  • I quote from the document: Reduction of Signal Voltage of DRAM Cell Induced by Discharge of Trapped Charges in Nano-meter Thick Dual Dielectric Film”, J. Kumagai, K. Toita, S. Kaki, and S. Sawada, Proceedings of the International Reliability Physics Symposium (IRPS 1990) "Trap/detrap characteristics strongly depend on stress voltage. Therefore, thicknesses and plate bias should be optimized by considering not only leakage current trough film but also detrap of trapped charge."
    – Hasbo
    Commented Dec 3, 2022 at 4:49
  • @Hasbo Not only are some cells "true cells" and others "anti cells" (which means a logical 1 may or may not be stored as a charge), contents written to memory are first XORed with the output of an LFSR, which effectively randomizes the bit pattern.
    – forest
    Commented Dec 5, 2022 at 1:46
  • do you mean that a classic memory dump reads logical values while the measurement technique examines physical cells? content is xored even in the case of a memory dump, but I guess what you mean... probably due to inaccurate values, we couldn't reverse the xor process right?
    – Hasbo
    Commented Dec 5, 2022 at 21:35
  • Scrambling was introduced with DDR3, at least this study suggests "Lest we forget: Cold-boot attacks on scrambled DDR3 memory" the condition is also that this technology must support your CPU. I am afraid that DDR2 is not scrambled.
    – Hasbo
    Commented Dec 5, 2022 at 22:58
-1

I think that the design of commercially available ram modules cannot be modified, at least not without damage and risk of data loss, as a result it is not possible to replace the dummy sense amplifier with a more accurate type that would read the exact cell voltage values from which it was possible to infer what the values have been stored for a long time. viz. picture

https://medium.com/@hritwik567/concurrent-refresh-aware-dram-memory-architecture-4ff2b2b302c8

It would be theoretically possible to use the pause time measurement technique of single cells as mentioned in "Reduction of Signal Voltage of DRAM Cell Induced by Discharge of Trapped Charges in Nano-meter Thick Dual Dielectric Film", J. Kumagai, K. Toita, S .Kaki, and S. Sawada.

User @Conundrum in the link Can RAM retain data after removal? states that this can only be done up to 256MB ram due to new geometries.

I think the same will apply to microscopic probing, although unfortunately I cannot confirm this. In addition, the memory modules would have to be tunnelled.

Furthermore, from the graphs of the reference cells in the aforementioned study, it can be seen that the DRAM voltage shift under normal operating conditions is not significant (+-0.05V) and returns to its original state in short time intervals even during the constant "1" write operation, and the pause time divergent slightly, but is stable and does not rise or fall.

In the link https://m.hexus.net/tech/tech-explained/ram/18846-ddr-ddr2-memory/ you can also find a mention of OCD (Off Chip Driver calibration)

I reckon that the previously investigated problem did not get worse, but on the contrary improved, even though the dimensions are reduced, because it also introduced other countermeasures such as material or a reduction of the operating voltage.

I think unwanted effects like hot carrier can occur to different degrees depending on different criteria, but it doesn't change the fact that the previous content cannot be reconstructed due to the previous reasons, provided that excessive thermal and voltage changes were not caused by malware or a hardware error.

https://www.eesemi.com/oxidebreakdown.htm

Improve this answer
1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Dec 2, 2022 at 21:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .