Cyber Security News

BadRAM Attack Breaches AMD Secure VMs with $10 Device

Researchers have uncovered a vulnerability that allows attackers to compromise AMD’s Secure Encrypted Virtualization (SEV) technology using a $10 device.

This breakthrough exposes a previously underexplored weakness in memory module security, specifically in cloud computing environments where SEV is widely used to protect sensitive data, which is shared on the BadRAM page.

Modern computers depend on DRAM (dynamic random-access memory) to store code and data, while processors perform computations.

The initial communication between a computer and its DRAM modules determines memory size, speed, and configuration.

However, what happens if a DRAM module deliberately deceives the processor? This study marks the first comprehensive examination of “bad RAM” — rogue memory modules that intentionally provide false data during startup, revealing a new vulnerability in processor security.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

BadRAM Attack Breaches AMD

Cloud computing has increasingly relied on encryption to safeguard data, particularly in environments where data breaches and insider threats are prevalent.

AMD’s Secure Encrypted Virtualization (SEV) is designed to protect virtual machines (VMs) by encrypting their memory and ensuring isolation even from sophisticated attackers.

However, the research highlights a critical vulnerability where tampering with the embedded Serial Presence Detect (SPD) chip on commercial DRAM modules allows attackers to circumvent SEV protections, including AMD’s advanced SEV-Secure Nested Paging (SEV-SNP) version.

Using off-the-shelf equipment costing less than $10, attackers can deceive the processor into accessing unauthorized encrypted memory.

The BadRAM attack not only compromises the security of AMD SEV but also enables the manipulation of remote attestation reports and the insertion of backdoors into any SEV-protected VM.

In response, AMD has released firmware updates aimed at securely validating memory configurations during the processor’s boot process to mitigate this threat.

In a demonstration, researchers showcased how the BadRAM primitive enables attackers to capture the contents of a memory location in a SEV-SNP VM and replay it, forming the basis for more sophisticated attacks.

This incident underscores the need for heightened vigilance and rapid adaptation in defending against emerging cybersecurity threats.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

QSC: Multi-Plugin Malware Framework Installs Backdoor on Windows

The QSC Loader service DLL named "loader.dll" leverages two distinct methods to obtain the path…

1 day ago

Weaponized LDAP Exploit Deploys Information-Stealing Malware

Cybercriminals are exploiting the recent critical LDAP vulnerabilities (CVE-2024-49112 and CVE-2024-49113) by distributing fake proof-of-concept…

1 day ago

New NonEuclid RAT Evades Antivirus and Encrypts Critical Files

A NonEuclid sophisticated C# Remote Access Trojan (RAT) designed for the.NET Framework 4.8 has been…

1 day ago

Hackers Targeting Users Who Lodged Complaints On Government portal To Steal Credit Card Data

Fraudsters in the Middle East are exploiting a vulnerability in the government services portal. By…

1 day ago

Juniper Networks Vulnerability Let Remote Attacker Execute Network Attacks

Juniper Networks has disclosed a significant vulnerability affecting its Junos OS and Junos OS Evolved…

1 day ago

Beware! Fake Crowdstrike Recruitment Emails Spread Cryptominer Malware

CrowdStrike, a leader in cybersecurity, uncovered a sophisticated phishing campaign that leverages its recruitment branding…

1 day ago