Quick Recap Before We Start

So far in this part, we’ve learned:

• Lesson 19: Programs use RAM by being loaded from storage, divided into neat sections, and swapped in/out when space is tight.

• Lesson 20: Virtual memory allows programs to pretend they have more RAM than actually exists, using pages and a page table.

Now, we ask a very different question:
👉 “What if someone tries to attack RAM directly?”

Yes, believe it or not, RAM can be hacked. In this lesson, we’ll explore how RAM can be attacked, what Rowhammer is, and how operating systems protect memory.

Step 1: Why Do We Need Memory Security?

Imagine you’re living in an apartment building. Each apartment belongs to a different family. Everyone has their own private space.

Now, imagine one sneaky neighbor starts poking holes in the walls, trying to peek at what you’re doing or even steal your stuff.

That’s exactly what can happen in computers. Each program should only see its own memory space. But sometimes, attackers find clever tricks to peek into other programs’ memory or even change it.

This is a huge problem because memory can store:

• Passwords 🔑

• Secret encryption keys (used to lock and unlock data)

• Personal information

• Even the core of the operating system itself

So protecting RAM is not just important — it’s critical.

Step 2: Memory Vulnerabilities – Cracks in the Wall

There are several ways RAM can be attacked. Let’s look at the most famous one: Rowhammer.

Step 3: What is Rowhammer?

The word Rowhammer comes from how RAM is organized.

How RAM is Structured

• Inside RAM chips, data is stored in tiny cells that are lined up in rows and columns.

• Each cell is like a tiny bucket of electric charge that represents a 0 or a 1.

The Trick

In Rowhammer, the attacker doesn’t directly touch the victim’s memory. Instead, they repeatedly “hammer” (rapidly access) one row of memory cells.

When they do this extremely fast, the electrical charge in nearby rows starts to leak or flip.

• A bit flip means a 0 turns into a 1, or a 1 turns into a 0.

This is like shaking a bookshelf so hard that books on the neighboring shelf fall over — even though you never touched them.

tep 4: Why Rowhammer is Dangerous

At first glance, flipping one bit might not seem scary. But computers are built on exact precision — changing even one bit can completely alter meaning.

Example:

• The number 1000 in binary is 1111101000.

• If one bit flips, it could become 1111100000, which is 992. That’s a mistake.

Now imagine if that flipped bit belonged to:

• A security check (“Is the user allowed? Yes/No”).

• A password hash.

• The memory of the operating system kernel (the most powerful part of the OS).

Suddenly, an attacker can break security barriers just by hammering RAM rows.

Step 5: Real-World Demonstrations

Rowhammer is not just theory. Researchers have shown:

• They could escape from a virtual machine (a safe “sandbox” inside a computer) by flipping bits in the host system’s memory.

• They could escalate privileges (go from being a normal user to an admin).

• They could bypass memory protections that normally separate programs.

This made Rowhammer one of the most famous hardware-level vulnerabilities of the last decade.

Step 6: Other Memory Attacks

Rowhammer is the star, but there are other memory vulnerabilities too:

1. Buffer Overflows

   • A buffer is a small section of memory reserved for temporary data.

   • If a program writes more data than the buffer can hold, it “overflows” into neighboring memory.

   • This can allow attackers to inject malicious code.

   Example:

   • A program expects you to enter your name (20 characters max).

   • You type in 100 characters.

   • The extra spills over into memory that wasn’t meant to be touched, possibly overwriting important instructions.

2. Cold Boot Attacks

   • RAM usually forgets everything when power is off.

   • But for a few seconds after shutdown, tiny traces of data may remain.

   • Attackers can freeze the RAM chips (literally with coolant spray) and quickly read out passwords or keys.

3. Side-Channel Attacks

   • Instead of attacking RAM directly, hackers measure indirect signals like power usage or timing to guess what’s in memory.

Step 7: How Do We Defend RAM?

Thankfully, engineers and operating systems have many defenses against these attacks.

Defenses Against Rowhammer

1. Error-Correcting Code (ECC) RAM

   • This type of RAM can detect and correct single-bit flips automatically.

   • It’s like having a spell-checker for memory errors.

2. Memory Refreshing

   • RAM naturally refreshes its cells regularly to prevent leaks.

   • Defenses increase refresh rates in areas under attack, so charge doesn’t leak.

3. Operating System Monitoring

   • The OS can watch for suspicious patterns of memory access that look like hammering and block them.

Defenses Against Buffer Overflows

• Modern systems use address space layout randomization (ASLR). This means memory locations are shuffled every time, so attackers can’t predict where to inject code.

• They also use “stack canaries” — little secret values placed in memory. If a buffer overflow changes them, the program knows it’s under attack and shuts down.

Defenses Against Cold Boot Attacks

• Encrypting RAM contents or wiping it immediately on shutdown.

Step 8: Why Memory Security Matters More Than Ever

In the past, people thought of hacking as mostly attacking software — like viruses or breaking into accounts. But modern hackers know that even the hardware itself can be attacked.

Since RAM holds everything the CPU is working on, a single weakness there can compromise the entire system.

This is especially important in:

• Cloud computing – Where many people share the same physical server. A Rowhammer attack could let one customer peek into another’s memory.

• Smartphones – Where sensitive data like banking apps and biometrics are in RAM.

• Servers – Where encryption keys for websites live in RAM.

So, protecting RAM is at the heart of keeping computers secure.

Step 9: Summary

Let’s recap in simple terms:

• RAM isn’t just about speed — it can also be a target for attackers.

• Rowhammer: Flipping bits by hammering nearby rows of memory.

• Buffer Overflows: Writing too much data into a memory space, spilling into others.

• Cold Boot Attacks: Recovering data after shutdown.

• Defenses include ECC RAM, refreshing, OS monitoring, ASLR, and encryption.

In short: Without proper defenses, memory can become the weakest link in computer security.