COMSEC is the computer security group of the Department of Information Technology and Electrical Engineering (D-ITET) at ETH Zürich . COMSEC is led by Prof. Kaveh Razavi .
Visit comsec.ethz.ch → On Hacker News Nov 2021 – May 2025
We demonstrate that it is possible to trigger Rowhammer bit flips on all DRAM devices today despite deployed mitigations on commodity off-the-shelf systems with little effort. This result has a significant impact on the system’s security as DRAM devices in the wild cannot easily be fixed, and previous work showed…
Branch Privilege Injection ( CVE-2024-45332 ) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race…
Our work shows that it is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations. This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems , which greatly increases the attack surface, considering today’s AMD market share…
Cascade is a RISC-V CPU fuzzer that generates valid , long and complex programs, and relies on a termination cascade-effect for bug detection. It detected 37 new bugs (29 new CVEs) in 5 RISC-V CPUs, which is more than all the existing fuzzers, combined. You can read a paper we wrote on Cascade here and try it out here…
Over the past one and a half years, we have studied two phenomena that enable an unprivileged attacker to leak arbitrary information on all modern AMD CPUs: