Battering RAM
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Researchers demonstrate a $50 hardware interposer that bypasses memory encryption on Intel SGX and AMD SEV-SNP cloud processors. The device sits between processor and DDR4 memory, passing boot-time security checks before activating to redirect encrypted memory addresses. This enables plaintext access to protected workloads and breaks attestation on fully patched systems. The attack exposes fundamental limitations in current scalable memory encryption designs, which lack cryptographic freshness guarantees. Open-source schematics are available, and both Intel and AMD have acknowledged the findings but consider physical DRAM attacks out of scope for current products.
Table of contents
Who conducted this research?Am I impacted by this vulnerability?Battering RAM needs physical access; is this a realistic attack vector?What are Intel SGX and AMD SEV; who uses this technology?How difficult is it to perform this attack in practice?Can this be fixed by software or firmware updates?Does memory encryption mitigate Battering RAM?How is this different from BadRAM?How is this different from WireTap or commercial DRAM interposers?What about other confidential computing technologies?Does Battering RAM also affect DDR5?What equipment do I need; are the hardware design and source code available?What is the response of Intel and AMD?What are the main takeaways of this research?Can I use the logo?Where can I find more information?3 Comments
Sort: