[Script Info] Title: [Events] Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text Dialogue: 0,0:00:00.45,0:00:02.86,Default,,0000,0000,0000,,Cool. So. I'm the second talk of the day. Dialogue: 0,0:00:03.49,0:00:05.59,Default,,0000,0000,0000,,And my talk is gonna be about Dialogue: 0,0:00:06.18,0:00:07.99,Default,,0000,0000,0000,,a paper with a pretty long title. Dialogue: 0,0:00:08.56,0:00:10.39,Default,,0000,0000,0000,,It's called Row Hammer Dialogue: 0,0:00:11.41,0:00:12.83,Default,,0000,0000,0000,,Flipping Bits in Memory Dialogue: 0,0:00:13.72,0:00:14.93,Default,,0000,0000,0000,,Without Accessing Them Dialogue: 0,0:00:15.39,0:00:16.77,Default,,0000,0000,0000,,colon, even more stuff. Dialogue: 0,0:00:17.15,0:00:18.68,Default,,0000,0000,0000,,And experimenting something Dialogue: 0,0:00:19.29,0:00:20.68,Default,,0000,0000,0000,,but that doesn't really matter. Dialogue: 0,0:00:21.15,0:00:22.37,Default,,0000,0000,0000,,So, my name is Vishnu Dialogue: 0,0:00:22.88,0:00:24.46,Default,,0000,0000,0000,,And I'm a year 4 Computer Science student Dialogue: 0,0:00:25.39,0:00:25.98,Default,,0000,0000,0000,,just like Chin. Dialogue: 0,0:00:26.76,0:00:28.77,Default,,0000,0000,0000,,and we are actually part of NUS Hackers. Dialogue: 0,0:00:29.59,0:00:31.34,Default,,0000,0000,0000,,It is a club/society in NUS. Dialogue: 0,0:00:31.92,0:00:33.47,Default,,0000,0000,0000,,This is my second time here. Dialogue: 0,0:00:33.85,0:00:35.62,Default,,0000,0000,0000,,I was here exactly 12 Papers We Love ago. Dialogue: 0,0:00:36.20,0:00:37.26,Default,,0000,0000,0000,,One year ago. Dialogue: 0,0:00:37.53,0:00:39.19,Default,,0000,0000,0000,,Audience: {\i1}aww{\i0} "Anniversary!" Dialogue: 0,0:00:39.86,0:00:42.03,Default,,0000,0000,0000,,... presenting the Diffie-Hellman Key Exchange Dialogue: 0,0:00:42.58,0:00:44.79,Default,,0000,0000,0000,,Which is also a security related paper Dialogue: 0,0:00:45.18,0:00:46.64,Default,,0000,0000,0000,,And today is another security related paper Dialogue: 0,0:00:46.88,0:00:49.03,Default,,0000,0000,0000,,Even though I have no academic experience Dialogue: 0,0:00:49.41,0:00:50.54,Default,,0000,0000,0000,,in security at all, Dialogue: 0,0:00:50.87,0:00:52.38,Default,,0000,0000,0000,,just seems to click with my interests. Dialogue: 0,0:00:52.75,0:00:54.10,Default,,0000,0000,0000,,So, the paper, Dialogue: 0,0:00:54.36,0:00:57.65,Default,,0000,0000,0000,,It's called... ah, colon... An Experimental Study of DRAM Disturbance Errors Dialogue: 0,0:00:58.23,0:01:00.24,Default,,0000,0000,0000,,This is a joint publication Dialogue: 0,0:01:00.56,0:01:01.83,Default,,0000,0000,0000,,by CMU and Intel Labs Dialogue: 0,0:01:02.18,0:01:04.43,Default,,0000,0000,0000,,The reason why it fascinated me so much is Dialogue: 0,0:01:04.87,0:01:07.58,Default,,0000,0000,0000,,We always talk about software exploits Dialogue: 0,0:01:07.79,0:01:09.21,Default,,0000,0000,0000,,as something to do with software. Dialogue: 0,0:01:09.70,0:01:10.16,Default,,0000,0000,0000,,It's a bug in software. Dialogue: 0,0:01:11.06,0:01:12.64,Default,,0000,0000,0000,,Either programmer made a mistake. Dialogue: 0,0:01:12.93,0:01:14.38,Default,,0000,0000,0000,,Or is usually a programmer made Dialogue: 0,0:01:14.78,0:01:16.66,Default,,0000,0000,0000,,a mistake somewhere Dialogue: 0,0:01:17.56,9:59:59.99,Default,,0000,0000,0000,,Or you forgot to check something. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,But this is a hardware bug. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,That affects software. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,And that fascinated me. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,A mistake in hardware, Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,or so-called mistake in hardware, Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,which you can not fix. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Because you can't patch hardware. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Is now affecting software forever. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,And it's almost unpatchable. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Just because of the way hardware is. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Once you release hardware. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,That's it. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,So before we talk about Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,what this paper is about Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,let me just give you a brief history lesson Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,on what DRAM is. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,DRAM stands for Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Dynamic RAM Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,And that's the kind of RAM Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,that we have in all of our machines Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Chinmay: Sorry, memory lane... Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Thank you. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Yep, a lot of jokes like that Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,sprinkled inside this talk. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,So DRAM stands for Dynamic RAM. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,And it's the kind of RAM Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,that we have in every single machine Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,that we touch these days. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Previously in the 90s there was Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,a thing called SRAM Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,but it wasn't performing enough Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,so they made this thing called DRAM Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,for Dynamic RAM. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Here's an example of a kind of DRAM module Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,This is the Micron something Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,and this is a 1 MB chip. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,So this entire chip holds exactly Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,1 megabyte of information Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Which means that... one million... Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Sorry...? Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Rahul: RAM chips are normally sold Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Rahul: in terms of bits. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Rahul: So when you say 1024 Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Rahul: that's 1024 megabit, usually. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Sorry, megabit. Which makes it 128 KB. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Sorry, you are right. it's actually 128 KB. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,And, yea, so there's actually like Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,1 million dots in here. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,If you count. Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,So each single dot here Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,Is called DRAM cell Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,And to understand the flaw here Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,We actually need to learn Dialogue: 0,9:59:59.99,9:59:59.99,Default,,0000,0000,0000,,exactly how a DRAM cell works.