Publications

In this paper, we present an end-to-end Rowhammer attack which can flip bits on Intel servers, without causing crashes. We demonstrate the effectiveness of our attack by hammering RSA public keys loaded into memory, causing the server to accept messages not signed by the original key.

In this paper, we show that Rowhammer attacks can in fact be more effective when combined with bank-level parallelism, a technique in which the attacker hammers multiple memory banks simultaneously. This allows us to increase the amount of Rowhammer-induced flips 7-fold and significantly speed up prior Rowhammer attacks relying on native code execution.

In this paper, we show that Chrome’s implementation of its centralized credential leakage detection protocol is vulnerable to several microarchitectural side-channel attacks that violate its security properties.