Senior Scientist @Google. Computer and Hardware Security. Tweets are mine and not my employer's. #downfall Previously: @UCSD @Qualcomm @WPI @TalosSecurity

San Diego, CA
Joined November 2015
Dropping #Downfall, exploiting speculative forwarding of 'Gather' instruction to steal data from hardware registers. #MeltdownSequel - Practical to exploit (POC/Demo) - Defeat all isolation boundaries (OS, VM, SGX) - Bypass all Meltdown/MDS mitigations. downfall.page
16
371
52
939
229,396
Proud to be part of this impactful effort.
Curious how we go about security reviews at Google? In this case, we teamed up with Intel to take a closer look at Intel Trust Domain Extensions (TDX) 1.5 and help secure the confidential computing space! For the details, 👇 bughunters.google.com/blog/a…
1
1
6
896
Daniel Moghimi retweeted
Trust matters, especially for technology like Intel TDX. See how Intel worked with our friends at @Google to improve platform security. ms.spr.ly/6014QPLHM
5
37
77
9,313
Daniel Moghimi retweeted
The new Rowhammer attack paper against SK Hynix DDR5 modules is very impressive! LPE to root in over 100 seconds, or disclosing RSA keys for SSH from adjacent VM, among other vectors. If the SK Hynix brand doesn't ring a bell, some models of ADATA, G.SKILL, Corsair, Dell, Lenovo and even some Cisco OEM modules are based on Hynix chips. Finding exact list of affected OEM vendors and module modules is a bit tricky. As part of the research effort Google has also partnered with Antmicro to build dedicated Rowhammer testing rig, which is also open-source! github.com/antmicro/rowhamme… Paper: comsec.ethz.ch/research/dram… Google blog: security.googleblog.com/2025… PoC: github.com/comsec-group/phoe…
Today, we present with *Phoenix*: 🔥 two new Rowhammer patterns + ⏱️ self-correcting refresh sync + 🔨 PC bit flips on all tested SK Hynix DDR5 DIMMs. More information: comsec.ethz.ch/phoenix #Rowhammer #DDR5 #DRAM #HardwareSecurity #ETHZurich #COMSEC
2
23
1
81
17,230
🔥 New hardware hack ALERT: ETH Zürich + Google just broke SK Hynix DDR5 memory wide open. ➡️ “Phoenix” (CVE-2025-6202) gets ROOT in 109s on SK Hynix chips ➡️ ECC & TRR defenses? ❌ Bypassed ➡️ RSA keys + sudo at risk Full story → thehackernews.com/2025/09/ph… 💡 Only fix: crank DRAM refresh rate 3×.
5
38
4
139
75,700
FFmpeg folks are talking about performance degradation due to Downfall (downfall.page) vulnerability, and if they can disable it. Short blog post on the issue: moghimi.org/downfall_perform…
Interesting patch from @Google showing the effects of Intel security mitigations on the gather assembly language instruction. A huge performance decrease as a result.
1
1
16
5,615
Deploying mitigations at scale is hard. It has been a couple of years since I discovered downfall.page / GDS attack. The performance degradation due to mitigation is bad, which may cause folks to disable them :(
Interesting patch from @Google showing the effects of Intel security mitigations on the gather assembly language instruction. A huge performance decrease as a result.
4
422
Daniel Moghimi retweeted
[Weekend read] Generalized Power Attacks against Crypto Hardware using Long-Range Deep Learning - elie.net/publication/general… Thrilled to finally publish our GPAM model and high-quality ECC datasets after years of intense R&D. Compared to existing approaches, the GPAM model represents a generational leap because it is able to attack multiple algorithms (AES, ECC) and countermeasures without the need for human intervention and without the need to pre-process the input traces. Full disclosure each attack requires about automated hyper-tuning: ~700 GPU/h of automated hyper-tuning. @jmichel_p @invernizzi @flowyroll #AI #CyberSecurity #cryptography #crypto #ResearchPapers
2
3
1,376
I didn't attend Usenix Security this year, but looking at the hardware security papers, only a small number solve real problems. This is unfortunate because I know that students put a lot of efforts into these papers. It looks like the gap between academia-industry is quite big.
1
31
3,136
Michael wasn't joking when he said fun ideas xitter.cf/misc0110/status/182123…
Replying to @flowyroll
Thanks! We are already working on some fun ideas
6
749
Daniel Moghimi retweeted
With the #GhostWrite CPU vulnerability, all isolation boundaries are broken - sandbox/container/VM can't prevent GhostWrite from writing and reading arbitrary physical memory on affected RISC-V CPUs. Deterministic, fast, and reliable - no side channels. ghostwriteattack.com/
8
156
21
487
95,788
I am looking for a new home. As I am typing my partner's name on Google calendar, it also suggests that I should add our current landlord to the meeting :) I am guessing this is just because we have had a shared history of exchanging emails. Yeah right, AI apocalypse is near.
1
4
821
Went to see the Duel Reality by @The7Fingers. Awed by this thrilling, psychedelic, acrobatic story telling. They are in town till August 4th. Don't miss out.
“This visual spectacle is a total delight and captivating throughout.” —Stage and Cinema Duel Reality features dazzling athleticism and non-stop feats! Come see this incredible show and watch as it excels in putting the gasp back into theatre! theoldglobe.org/duelreality
3
570
Daniel Moghimi retweeted
Well of course CrowdStrike claims they do the same thing as Capsule8. This is how the industry works. Every time a small company creates an innovation, the big companies claim they already do it, or that are about to release something better. It's not true. This works because customers are idiots and don't know the difference. It's helped by the fact that "industry analysts" also are rarely technical enough to know the difference. They usually judge things by who has the best marketing on the issue and what the customers say. They don't have tech experts who put the thing under test. This is not because corporations are evil. For example, back in the day, my product competed against the open-source Snort. The Snort community did exactly the same thing, claiming they had the same innovative features as my product, even though they laughably didn't. That's why "Zero Trust" is just a stupid buzzword. At one point in time there were some innovative vendors doing Zero Trust stuff. But as soon as that term got traction in the industry, suddenly EVERY cybersecurity vendor was a "Zero Trust" vendor, and industry analysts got on board with this. It thus became impossible for average customers to determine which were the true Zero Trust innovations and those that really weren't. People would buy "Zero Trust Firewalls" and deploy them exactly the same way as old firewalls, and then proclaim they had a successful Zero Trust transition. I'm not trying to criticize CrowdStrike here. They had exactly the same problem when they were just starting out and every AV vendor repositioned themselves as being an EDR vendor. But now they are the big company in the space, and now they are doing the same thing. Every small innovator that becomes successful will turn around and do it. The fix isn't to make vendors more honest but for customers to actually pay attention to technical details. If you believe the sales person from CrowdStrike who says "we do the same thing" then you are an idiot who deserves the crap that you buy.
A friend texted and said "your twitter is brutal this morning" Here's the thing. Between 2018 and 2021 CRWD would blatantly lie to their existing customers (of win agent) to not pursue Capsule8 for Linux. They would say they have a Linux agent that does what we do, except..
3
10
4
60
10,842
The Twitter/X AI overlords now recommend me more block chain content because of the crowdstrike outage. Are these things this bad?
1
2
454
If I were crowdstrike, I might have as well started monetizing on ads. Such a waste of opportunity to not show customers some ads while protecting them against other adware.
1
1
450
On a positive note, we take a break from the LLM/GenAI madness for a day, at least.
6
450
What would happen if one pushes out a buggy firmware that would make a chipset not to boot? Brick billions of computers, sending parts to dumpster 👿
What a case study of systemic risk with CrowdStrike outage... that a few bits in the wrong place can brick ~1 billion computers and all the 2nd, 3rd order effects of it. What other single points of instantaneous failure exist in the technosphere and how do we design against it.
1
2
604