COcortesoft·Mar 25, 2024
Rowhammer has a javascript implementation that can run in the browser: https://github.com/IAIK/rowhammerjs
In ZenHammer: Rowhammer attacks on AMD Zen-based platformsisec-tugraz
rowhammerjs
C++2015–2024
isec-tugraz / rowhammerjs
rowhammerjs
Rowhammer.js - A Remote Software-Induced Fault Attack in JavaScript
13Distinct people
15Mentions
0Explicit recommenders
523GitHub stars
What to know before exploring
What it is
Rowhammer.js - A Remote Software-Induced Fault Attack in JavaScript
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year15 dated mentions
Observed mentions: 2015-07-27 12:16:40 UTC to 2024-03-25 20:11:41 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
15 sources> Not at all.
https://github.com/IAIK/rowhammerjs
This has existed for years and its use has been observed in the wild. RowHammer isn't new.
In Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations> If it comes to that you'll hear about it on HN first. If folks start to explot it you'll hear about it.
It did come to that, years ago: https://github.com/IAIK/rowhammerjs
In Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigations> What are the realistic attacks that this vulnerability allows?
https://github.com/IAIK/rowhammerjs
In Blacksmith – Rowhammer bit flips on all DRAM devices today despite mitigationsWhat about something like https://github.com/IAIK/rowhammerjs ?
In How Shopify Uses WebAssembly Outside of the BrowserRowHammer most certainly works in a VM:
https://github.com/IAIK/rowhammerjs
In Wasmjit: Kernel Mode WebAssembly Runtime for LinuxWhat's more, rowhammer can be done from js: https://github.com/IAIK/rowhammerjs
In Is Your Site Leaking Password Reset Links?You can even execute the rowhammer attack from the loaded javascript: https://github.com/IAIK/rowhammerjs There's no protection against it really. It doesn't matter if you can scan APKs for this behaviour if any app can open a webview with the right page.
In Using Rowhammer bitflips to root Android phonesYou can execute it from regular JS https://github.com/IAIK/rowhammerjs
In Once thought safe, DDR4 memory shown to be vulnerable to “Rowhammer”"The hard truth is that if this code was written in JavaScript, it wouldn’t have been vulnerable."
I'd be very, very careful making broad "interpreted language X would prevent this bug" statements - not only is it dependent on the VM not having remotely-exploitable issues, there's also the matter of VM-to-host leakage. For instance, it's possible to exploit the row-hammer behavior of the host system's DRAM from Javascript:
https://github.com/IAIK/rowhammerjs
In A Skeleton Key of Unknown Strength (CVE-2015-7547)Except, it does.
Remember RowHammer? https://github.com/IAIK/rowhammerjs
In Things I learned from OpenSSH about reading very sensitive filesIt takes more than an attention-grabbing headline to make something clickbait. There is no real financial incentive here; they gave their talk a provocative title so people would show up. There are not misrepresenting the facts; you can get root from JavaScript using Rowhammer, and they'll tell you how.
Additionally, there is something called Rowhammer.js:
https://github.com/IAIK/rowhammerjs
In Rowhammer.js: Root privileges for web apps?> As a desktop user I need little to none scrtuiny. My web browser, IDE, toolchains, IM, video player and computer games all work together well and while technically any one could own any other, this simply does not happen. It takes some (little) skill to avoid obvious malware, and then generally you're fine.
It's not just downloading malware that is an issue; you also have to worry about security flaws in the apps you trust. Web browsers are a perfect example; they are constantly downloading untrusted code and executing it. Even when the javascript engine doesn't have a flaw, you have exploits like Rowhammer.js[1] which sidestep them entirely.
> It takes some (little) skill to avoid obvious malware, and then generally you're fine.
I think you're underestimating the knowledge needed to secure your computer properly, and overestimating the
Read the rest
savy of the majority of users. The current state of computer security (huge botnets, etc.) is a testament to the fact that the current model isn't cutting it.
> On the other hand, I get to open my video file in my IDE, edit IM's data files in a word processor, and move things around seamlessly with OS; everything is expected to work and no program tries to lock me in.
If the lock in is an open file dialog, or passing a filename by command line, all of the examples you list would work fine.
> Desktop environments don't need that much sandboxing because there isn't that much crap going on.
You are missing an important difference; most users are far more liberal in downloading apps for mobile than for desktop, and if they were just as liberal on their desktops they would be pretty much guaranteed to get malware. Because of this, many apps which are only used in a browser on a computer are used as apps on mobile (which is needed at the very least for performance reasons). Sandboxes aren't perfect, but they move the ability to infect a device via installation from "totally trivial" to "requiring significant vulnerability".
[1]: https://github.com/IAIK/rowhammerjs
It must be really slow in order to avoid attacks like this one: https://github.com/IAIK/rowhammerjs
In Let’s sunset C/C++Rowhammer.js – A Remote Software-Induced Fault Attack in JavaScript
23 points · Open discussion