Encryption:

Ans:

Although randomness is a pipe dream in the strict mathematical and scientific sense, pseudo-

randomness is a useful and practical reality, particularly in cryptography.

True Randomness vs. Pseudo-Randomness:

True Randomness: This derives from unpredictable physical phenomena (such as, radioactive

decay, thermal noise, quantum effects). These are inherently non-deterministic (according to our

current scientific framework for understanding randomness).

Pseudo-Randomness: Generated algorithmically by deterministic machines. A pseudo-random

number generator (PRNG) will always output the same sequence of numbers if it was begun with

that same input. Therefore, it is not truly random. But, if designed well, the PRNG will produce a

sequence that appears random to any observer.

In a deterministic world, true randomness existence isn’t possible. Any system’s current state is

fully dependent on its previous state. A computer is a deterministic machine, and it will always

generate the same output for a given input. An algorithm just following a set of instructions, is

so-called “random” number algorithm. That algorithm is simply a deterministic algorithm. This

process is predictable, which is not random. You can use physical processes to generate what we

would call true randomness, but those physical processes are subject to the laws of physics and

are not truly random. As we can work within those laws, they will produce deterministic results

for the same inputs. For instance, radioactive decay or air noise are used to generate random

numbers, but in real we would only be accepting that they do produce such numbers.

In cryptography, randomness is essential to protect data, using secure session keys and one-time

passwords as examples. An early implementation of SSL by Netscape utilized the time of day

and process ID in generating random numbers, making encryption keys guessable. Weakness in

randomness can also create trends where attackers can take advantage of them. This issue is

avoided by appropriately seeded pseudo-random number generators, which create outputs

sufficiently unpredictable to achieve system security.

Due to the difficulty to achieve true randomness, pseudo-random number generators (PRNGs)

were created. These algorithms use a small, initial piece of information, which is called seed to

produce a long string of numbers that appear random. A good PRNG produces a string of

numbers that is statistically indistinguishable from a truly random string.

In other words, the numbers pass statistical tests for randomness like distribution, and a lack of

pattern. Since the entire string of number is entirely determined by the seed, if you know the

seed, you can reproduce the entire string. This can be a weakness for some applications, but in

cryptography, it is a feature. The security of a cryptographic system relies on the unpredictability

of the seed, not the PRNG algorithm.

To summarize, randomness as an ideal concept may be a pipe dream. But randomness as a usable

tool is real enough for cryptography.

Apple had a user-experience issue, not a cryptographic one. True randomness can produce

repetition (the same song played twice in a row), but humans expect a "random" experience,

which is more evenly distributed. So, Apple used pseudo-randomness, that is random samples

and then shuffle choices constrained without repeats. That highlights a critical point: randomness

for machines is NOT randomness for humans.

Conclusion:

Randomness does exist in nature, and we can use it with TRNGs. But because computers are

deterministic, they rely on PRNGs which makes randomness more of a controlled simulations

than a pure reality. For cryptographic purposes, PRNGs seeded with robust entropy creates a

random experience to support the security of system.

Each week, we will have a "This Week in Cybersecurity" discussion that focuses on developing

issues in Cybersecurity, with a focus on encryption related topics when possible. This discussion

will provide you the opportunity to stay 'attuned' to current Cybersecurity issues in the news and

share at least one event, activity, or development with the class. For example, if a major cyber-

attack on a nation-state or major company (i.e., North Korea attack on Sony) were to occur, this

would be the type of story to share.

Find an encryption and/or Cybersecurity-related current event, activity, or development in the

news. In your discussion post, briefly summarize the event and reflect on its significance. You

should use any legitimate news source (television, internet, periodicals, etc.) to support your

topical input. (A few sites related to cybersecurity are suggested on the Student Resources page,

but you are not limited to these.) Questions to address might include:

 How does the event relate to issues addressed in class?

 How might similar situations be mitigated?

 What is the broader impact of the event (e.g., nationally, globally, etc.)

Include a link to the story or a citation so that others may read the story.
Ans:

This Week in Cybersecurity — DDR5 RowHammer (18 Sept 2025)

News Topic: Hackers can flip bits in RAM to escalate privileges and take over systems

Summary:

The article describes an important cybersecurity development: a new RowHammer attack called

"Phoenix" that can flip bits in modern DDR5 RAM and escalate privileges on a system. A

research team (ETH Zurich) funded by Google, has presented a new RowHammer attack, which

is called Phoenix—that consistently flips bits in commodity DDR5 memory modules (tested

using SK Hynix modules and AMD Zen systems). The attack succeeds in exploiting a range of

common defenses (e.g., TRR) and even provides a long-term advantage (delaying ECC

mitigation). The attack will escalate privileges to root on a standard Linux configured desktop in

as little as 109 seconds. The researchers published a PoC code and suggest, as a mitigation

strategy, to increase DRAM refresh rates (to triple tREFI), which is effective though costly.

Vendors are issuing BIOS updates (Fine-Granularity Refresh), but researchers warn that these

BIOS updates may not be fully protective. (Published: 18 Sept 2025 — Cybernews / ETH Zurich

/ Google research.)
How it Relates to Class Topics:

This event captures the continuous historical cat-and-mouse interaction between attackers and

defenders. It also shows that flaws can exist at the most basic levels of computing in the

hardware and can entirely undermine the security measures at higher-level. We may be used to

focus about software vulnerabilities, but this illustrates a more basic principle that an attacker

can exploit physical properties and electronic charges to bypass all logical defenses of the

system. This attack demonstrates that, in addition to those discussed possible defenses, we can

practically develop the capabilities of physical interfaces like Error Correcting Code (ECC) and

TRR that enhance reliability to prevent the effects of bit-flips. Yet, an attacker can find a way to

exploit those systems.

How similar situations might be mitigated:

 Hardware and vendor updates: Adapting the new DRAM designs and firmware that

include strong mitigation; microcode / BIOS updates that changes refresh behavior.

 Increased refresh / FGR / tREFI changes: Tripling refresh rate is likely to prevent

flips, but it also increases power and heat and may shorten hardware life.

 System level defenses: Hardened OS memory layout, pointer integrity checks,

redundancy on critical data like checksums.

 ECC + monitoring / tracking: ECC helps but has limits – combine with runtime

integrity checks and/or anomaly detection for unusual bit-error patterns.

minimizing the ability of unprivileged code to execute high-frequency memory accesses;

sandboxing and privilege separation to limit the blast radius.

Broader impact:

If applicable across many DDR5 devices, RowHammer variants can become a widespread

vector for privilege escalation (in desktops, cloud hosts, embedded systems, etc.) globally. This

is especially concerning for cloud providers (multi-tenant risk), critical national infrastructure

that relies on COTS hardware, and other long-lived devices that may not receive updates

frequently. This also raises the issue of coordinated disclosure and the potential to encourage

certain regulatory guidance in security standards related to hardware.

Source / Citation:

Hackers can flip bits in DDR5 to take over systems, Google-backed research shows. (2025,

September 18). Cybernews. [Link]

to-bit-flip-attacks/
Nice post, Pratichhya! The disclosure of VMSCAPE highlights that hardware
level flaw can ultimately undermine even robust encryption methods. I
concur with your point that encryption is only as secure as its environment,
and this matter shows how speculative execution vulnerabilities can lead to
leak of secret data such as disk encryption keys, even in trusted
environments. The cloud impact is significantly concerning, especially with
multi-tenant virtualization rely heavily on VM isolation. Vendor patches and
mitigations like IBPB are important, but it also supports that the constant
need for collaboration between hardware manufacturers, cloud providers,
and security researchers. Once again it reinforces that in cyber security - we
can't just focus on algorithms - we must take a holistic approach in dealing
with hardware, software, and implementation.

Thanks for sharing this, Gopichand! The TA415 campaign you described shows how advanced
persistent threats are evolving by abusing legitimate tools like VS Code Remote Tunnels to
maintain stealthy access. I find it striking how attackers blend social engineering with technical
exploitation, using trusted names and file-sharing services to bypass initial defenses. Your
mitigation points are very practical—especially the importance of monitoring for unusual
scheduled tasks and unauthorized tunnels, since those can easily go unnoticed in large
organizations. This case really emphasizes that phishing awareness, strong email security, and
EDR visibility are all crucial for defending against state-sponsored threats. It’s also a reminder
that attackers will increasingly exploit common developer tools, so organizations need to include
those in their security monitoring.

Thank you for sharing this, Gopichand! The TA415 campaign you described is an example of
how APTs are changing; now abusing legitimate tools such as VS Code Remote Tunnels, to
maintain stealthy access. I find it interesting how attackers have combined social engineering
with a technical exploit, taking advantage of trusted names and file sharing services to bypass
perimeter detection. Your points on mitigation are very practical, particularly the need for
monitoring unusual scheduled tasks and unauthorized tunnel access into environments where
those processes could easily go unnoticed in large organizations. The case study emphasizes the
idea that phishing credentials, Email protections, and EDR visibility are crucial to defend against
state sponsored hacking. I also find it important as a reminder that APT threats will increasingly
exploit common developer tools, and organizations must include those in their security
monitoring.
Excellent post, Muniteja! I appreciate the breakdown of the theoretical vs practical role of
randomness. The use of the iPod shuffle example makes the concept much easier way for me to
understand the concepts you're discussing especially regarding how individuals' perspective of
randomness often differs from an objective viewpoint of randomness. I also agree with your
point that perfect randomness is likely unachievable, but for cryptographic applications well-
designed Pseudo-Random Number Generators (PRNGs) are more than sufficient. If the seed is
sufficiently strong and unpredictable, the security they offer is computationally reliable. This
balance between theory and practice really highlights why we continue to utilize
PRNGs as the backbone for secure systems.