PhD Student @CISPA Helmholtz Center for Information Security.

Saarbrücken
Joined June 2023
After a long embargo, I'm happy to announce the public launch of our website on our latest finding: GhostWrite. Our research uncovered a critical CPU bug that compromises all security isolations on affected RISC-V hardware. ghostwriteattack.com/ #GhostWrite #BlackHat #BHUSA
3
57
3
118
22,858
Fabian Thomas retweeted
The @Scaleway EM-RV1 OSes were patched several months ago. The default installation disables problematic instructions, and customers who installed their machines before have been contacted. Reminder: scaleway.com/en/docs/bare-me… I'd like to thank the @CISPA researchers who contacted us in advance to help manage the problem before making it public. It's sad that such a flaw exists on the TH1520's C910, but fortunately it stems from an error on a draft instruction set that can be software disabled. On the other hand, one of the advantages of open processors is that it allows external entities to look at the sources and see what has been done beyond the usual techniques. #ghostwrite #riscv #rvv #cybersecurity #security #cloud #baremetal
1
5
19
1,461
Want to learn how to get root on the T-Head C910 #RISCV CPU within seconds? Visit our website ghostwriteattack.com covering the #GhostWrite vulnerability. #BlackHat #BHUSA
2
4
1
8
1,251
Had a nice talk about #GhostWrite today together with @hetterichlorenz at #BHUSA. Our demos included reading arbitrary memory and escalating privileges. Further, we showed how #GhostWrite can interact with physical devices. Stay tuned for the recording. ghostwriteattack.com/
1
18
857
Fabian Thomas retweeted
With the #GhostWrite CPU vulnerability, all isolation boundaries are broken - sandbox/container/VM can't prevent GhostWrite from writing and reading arbitrary physical memory on affected RISC-V CPUs. Deterministic, fast, and reliable - no side channels. ghostwriteattack.com/
8
156
21
483
95,791
Fabian Thomas retweeted
Finally received my visa today! Unfortunately, I can't book everything in time for #BHUSA, so I'll miss the chance to present. However, you definitely shouldn't miss these two incredible talks: 🗓️ Wednesday | 🕙 10:20 AM 🗓️ Thursday | 🕒 3:20 PM
1
2
1
22
2,260
Join Lorenz (@hetterichlorenz) and me tomorrow at our #BHUSA briefing "Arbitrary Data Manipulation and Leakage with CPU Zero-Day Bugs on RISC-V." We'll unveil a novel architectural CPU bug that breaks all security isolations on affected RISC-V hardware. blackhat.com/us-24/briefings…
8
1
19
2,371
Fabian Thomas retweeted
In "Indirect Meltdown", we (@fth0mas, @____salmon____ , @Rayiizzz, @misc0110) show that transient-execution attacks can be turned into side-channel attacks (on fully patched machines)! If you want to know more or play around with our PoC: github.com/cispa/indirect-me…
1
3
17
1,250
Fabian Thomas retweeted
In "Reviving Meltdown 3a", we (@fth0mas, @____salmon____, @Rayiizzz, @misc0110) analyzed 19 CPUs for the system registers that we can still leak using Meltdown 3a. Find the details and the tool to check your own CPU here: github.com/cispa/regcheck
1
2
8
1,138
Fabian Thomas retweeted
Had the pleasure to present two papers at ESORICS today! The first analyzes the remaining attack surface of Meltdown 3a, the second (presented together with @fth0mas) shows that we can use Meltdown-US to leak the cache state of kernel structures on fully patched systems! 1/n
1
6
26
3,410
Fabian Thomas retweeted
I am happy to announce that Collide+Power, our new and generic software-based power side-channel technique, has been accepted at @USENIXSecurity 2023 #usesec23. collidepower.com
4
31
4
81
20,110
I'm thrilled to present our (@____salmon____, @misc0110) work Hammulator, a parameterizable Rowhammer simulator, at #DRAMSec 2023 (June 17). Our simulator supports both syscall and full-system emulation, enabling comprehensive analysis of #Rowhammer attacks and mitigations.
4
6
950