Answers to some of the questions at the end, from future me:<p>- It also works on LPDDR5, LPDDR4<p>- Yes, it works on ARM platforms (at least, the ones I tried).<p>- The simplest way to trigger similar faults electronically is via a high-speed mux IC, as described in <a href="https://stefan-gloor.ch/ddr5" rel="nofollow">https://stefan-gloor.ch/ddr5</a> (chipshouter also works, but is less elegant imho!)<p>- Yes, you can get webkit addrof/fakeobj primitives like this, although I didn't write an end-to-end exploit.<p>- You can pwn nintendo switch kernel with an adjusted exploit strategy, but the same adjusted strategy does not work on Switch 2, due to memory encryption (one bitflip corrupts a whole cache line). But other strategies may be possible? (notably, it is possible to block a whole write operation from happening at all - see also <a href="https://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was-hacked/" rel="nofollow">https://rdist.root.org/2010/01/27/how-the-ps3-hypervisor-was...</a> )
I also spent a long time trying to do the glitching with a mosfet, but never got it to work. I couldn't get enough drive strength to actually glitch anything, without messing with the delicate capacitance+impedance tolerances of the bus.
pfff, root, back in my day we hacked a vending machine with a lighter and got free coke.<p>No idea who discovered it, but the machine back at my school had an infrared interface for servicing, and you could trigger an interrupt with the flash of the flintstone of a lighter. Because it's just some 90s microcontroller, it would simply reset after failing to receive a valid command and forget what it was doing previously.<p>All you had to do was order a coke, and right when it drops out, before it subtracts the amount, you flash the lighter in front of the IR port like a magician, say the magic words and bam - free coke!
my prediction before reading is that they're using the piezo sparker to beat the DUT over the head with a big EMF spike<p>Edit: Nailed it!
Uh... yeah.<p>Just hold the sysadmins hand over the lighter until they tell you the password.<p>Never forget the easy way in ... the humans.
Like the classic xkcd on security<p><a href="https://xkcd.com/538/" rel="nofollow">https://xkcd.com/538/</a>
Good luck hacking a Switch using that method and getting away with it.
> Finally, I'd like to thank JEDEC for paywalling all of the specification documents that were relevant to conducting this research.
Yes. We do this in Australia, around the bars and pubs getting a root with only a cigarette lighter is a classic move.
I had an australian colleague who found it endlessly funny that we pronounced "router" as "rooter" instead of their "rowter". statements like "If that happens the system will root the packets via the rooter first" was met with much giggling
I feel like getting root privileges means something else in Australia.
also free arcade credits :}
Yeah but can you light a cigarette with only a laptop? Checkmate atheists! /s