Schneier on Security

Clive Robinson • September 15, 2025 3:23 PM

@ Ismar, ALL,

How low in the computing stack?

With regards, the attacks it’s important to note there is a very valid and mostly unavoidable reason for,

“they exploit memory safety vulnerabilities, which are interchangeable, powerful, and exist throughout the industry,”
“

In effect the memory sits quite a few levels in the computing stack below not just the ISA of the CPU, but below the CPU data and address busses and below the likes ob “the bus controllers” that give other functionality such as the “Memory Management Unit”(MMU) controller that allows the all important “Virtual Memory”(VM) that nearly all consumer and commercial multi-process OS’s need. The “Direct Memory Access”(DMA) controller that is essential for efficient I/O. And quite a number of other quite similar in base control design but seen as fundamentally from above in the controllers as you get toward the CPU layers.

The reason is for all the razamataz over minutia in specification differences in memory interfacing at the end of the day they are sufficiently broadly the same that an attack works against most memory regardless of the CPU layer and above. And also almost regardless of all the memory controllers as the closer the attack works toward the bottom of the stack the more wide ranging the targets that can be attacked.

Such attacks get seen as part of “bubbling up” attacks, in that like in a glass of champagne or similar the “attack bubble” grows as it bubbles upwards from the attack point way down to cause huge disruption at the surface. As with the gas in the wine such bubbles start at or as close to the molecular level as the attacker can reach and where human eyes can not see. In essence it was what the “Rowhammer Attack” was, the first that was well publicised in the modern era. Even though DMA attacks via serial and parallel IO lines “direct to memory bytes” were well known to electronic design engineers back in the late 1970’s and continued for decades with the likes of Apple’s FireWire and other interfaces.

Later, though harder, the attacks got expanded into MMU attacks of very great power. In essence handing over the entire CPU and memory to the attacker at one of those “Ring -3” and similarly named approximations.

The thing is that “bits of memory” are absolutely every thing to the CPU layer thus control the CPU’s behaviour in every way.

And there with-in is the “ultimate one ring” meme for geeky-nurds. That whilst very it is a very real threat, and makes a very good “SciFi Trope”, is in reality very difficult to effectively field.

For instance a Rowhammer Attack can actually be easily spotted on “bus signals” that radiate out usually loud and clear in the EM switching noise. Yes it can be made a little more covert but not by very much under current hardware constraints.

Other Rowhammer and other attacks can be limited by forms of “parity or ECC” hardware at the memory level of the stack and upwards.

The problem is not spotting memory changes, whilst doing it quickly and easily the real problem is that always,

“errors can slip through as not errors”.

No matter what the coding in the error checking for that byte/word of memory is used.

This means checking multidimensional checksums that cover multiple bytes/words. I was doing this in not just industrial systems, intrinsically safe and fail safe systems… I was doing it in “payloads” for launching and running independently from a launch or mother ship.

NASA put this sort of technology on the two Voyager probes if people want a famous time reference. But it was also done in the 1950’s and 60’s with some of the codes used coming out of mathematicians involved with GCHQ and belatedly NSA. Back at a time when even knowing “Linear Feedback Shift Register”(LFSR) taps were considered the equivalent of “munitions” or “state secrets” by some people…

Clive Robinson • September 18, 2025 2:13 AM

@ not important, ALL,

With regards,

“Now and then, a solar storm rushes to Earth, prompting a barrage of articles warning about potential disruption of the global power supply and phone and satellite communication.”

Yup, and we sometimes get hit by what was once described as,

“A metric shit ton of particles.”

The thing is mostly from our,

“down on the ground perspective”

It’s nearly all EM Radiation that has a low enough frequency so has next to zero effect on “biologics”.

However two things to note,

1, Society is now fairly dependent on “force multipliers” of very many kinds. Unfortunately they are all very much dependent on the movement of electrical charge (not that they need be).

2, The higher above the ground something is, the higher the frequency of the EM radiation to the point that even biologics will be detrimentally effected.

So you are at more danger with regards this aspect of Space Weather in an aircraft than a car. Though for any given distance you are in the aircraft less time than the car. So the lines on the graph are not linear enough to be intuitive to most people without quite a bit of other information.

But sometimes things are also very sensitive to even very small things thus can appear to be or are actually chaotic in nature.

For instance from the past couple of days we have,

https://m.youtube.com/watch?v=xzoxXGTDLyM

And the unexpected behaviour caused by “this little pit of blue” that gave a G3 Storm. That although we did feel it, as far as I’m aware –not that I’ve been looking– has not caused much of note.

Though with a bunch of radio blackouts and complex issues with Global Navigation Satellite Systems coming over the next few days… You might get insurance companies getting “My GPS told me the duck pond was the village carpark” stories 😉

With regards,

“undersea cable repeaters’ could be affected?”

Yup as can any long conductor running in the right direction.

At school you might well have been shown a very simple “cork and pin motor”. Where a magnetic field apparently drags the motor rotor into action.

The problem is the simplicity of what you would have been shown hides a lot of “technical details”.

Just one of which is if sufficient charge moves through a conductor then things start to warm up.

If they get too warm then those conductors become fuses, and things “burn out” with the induced current.

But also as the current goes up so does the voltage, and this can all to easily permanently damage the insulators in semiconductor junctions.

Whilst a body of water will screen out high frequency voltage signals.

Water does not screen magnetic fields at low frequencies…

So if protection devices are not functioning, or just not fitted, then things will suffer from the induced physical effects.

I can give you other info like why parts of North America are particularly vulnerable and why we can not always have protection devices that will work, but it will be “a lot of column inches”.

Just remember that at some point we will get hit by a “big one” and those charged particles will burn through to ground level taking any biologics with them. It’s not a question of if but when with the probability increasing with time.