FileVault 2 Easily Decrypted
reviews.cnet.com
FileVault 2 Easily Decrypted
1–10 of 34 posts
Re: FileVault 2 Easily Decrypted
#2tl;dr: direct memory access via firewire can recover the key within an hour.
Anyone know if firewire be disabled at the hardware level on macs?
Re: FileVault 2 Easily Decrypted
#3Actually this applies to "all" other similar encryption technologies and is not limited to mac or firewire. You can also use Thunderbolt, PCMCIA, ExpressCard and even esata ports to have direct access to a computers RAM in which you passphrase is being held.
Basically all ports which use DMA are possible if I remember correctly.
Further reading:
Re: FileVault 2 Easily Decrypted
#4Actually this applies to "all" other similar encryption technologies and is not limited to mac or firewire. You can also use Thunderbolt, PCMCIA, ExpressCard and even esata ports to have direct access to a computers RAM in which you passphrase is being held. Basically all ports which use DMA are possible if I remember correctly. Further reading: http://en.wikipedia.org/wiki/DMA_attack
Basically the only "defense" is to shut your computer down when you're leaving it alone / unattended for some time.
Re: FileVault 2 Easily Decrypted
#5Actually this applies to "all" other similar encryption technologies and is not limited to mac or firewire. You can also use Thunderbolt, PCMCIA, ExpressCard and even esata ports to have direct access to a computers RAM in which you passphrase is being held. Basically all ports which use DMA are possible if I remember correctly. Further reading: http://en.wikipedia.org/wiki/DMA_attack
Basically the only "defense" is to shut your computer down when you're leaving it alone / unattended for some time.
Turning off the machine can be easily socially engineered around by a determined targeted attacker; all from fire alarms to a visit from IT staff to giving you a free memory stick at a trade show and so on. If you were to be gifted a new USB keyboard tomorrow from some random company, you'd likely accept it unquestioningly.
Also, given that you leave your computer unattended, even whilst turned off, gives the attacker opportunity to insert a small device out of sight, rather as cleaners really have done with keyloggers on computers at banks.
Isn't when you are present the time when its hardest for them to attack because of the physical contact required?
Of course, in films the robber-dressed-as-janitor always manages to walk into the server-room with a tool box..
There are three types of attacker, right?
1) your password/data is valuable, its a targeted attack, the attacker will take the risk of direct access to the machine; they can do this by socially engineering you to insert the trojan hardware, or they can add some small hardware dongle when you don't see or understand
2) law enforcement, they will grab the machine, you'll know they have done so; DMA attack is just a lot more straightforward than freezing it and probing type attacks.
3) those prepared to use a $5 wrench http://xkcd.com/538/
Re: FileVault 2 Easily Decrypted
#6Actually this applies to "all" other similar encryption technologies and is not limited to mac or firewire. You can also use Thunderbolt, PCMCIA, ExpressCard and even esata ports to have direct access to a computers RAM in which you passphrase is being held. Basically all ports which use DMA are possible if I remember correctly. Further reading: http://en.wikipedia.org/wiki/DMA_attack
Basically the only "defense" is to shut your computer down when you're leaving it alone / unattended for some time.
Why won't disabling features which give easy access to ram work?
Re: FileVault 2 Easily Decrypted
#7tl;dr: direct memory access via firewire can recover the key within an hour. Anyone know if firewire be disabled at the hardware level on macs?
I was going to suggest filling the socket with dried play-doh, but thus guy reckons removing the kernel extensions could help:
https://discussions.apple.com/message/9200953#9200953
Though that's a bit crude...
I'd be interested too.
Re: FileVault 2 Easily Decrypted
#8Earlier quoted context omitted.
Basically the only "defense" is to shut your computer down when you're leaving it alone / unattended for some time.
Why won't disabling features which give easy access to ram work?
It would have to be disabling by omission.
I've seen dumb terminals for military networks that simply don't have any slots for any peripherals.
Which means staff go to great lengths to work around these limitations and basically open everything up and email documents to their hotmail account so they can print them off elsewhere etc.
Re: FileVault 2 Easily Decrypted
#9Earlier quoted context omitted.
Basically the only "defense" is to shut your computer down when you're leaving it alone / unattended for some time.
Why won't disabling features which give easy access to ram work?
Because the point of DMA is to give fast access to RAM without involving the CPU. That is what makes the speed of Firewire or PCMCIA or Thunderbolt or PCIE feasible. Without DMA, these technologies would not work.
Also, the password needs to be stored in memory and accessible by DMA, since you would not be able to use it without having it readily available.
Re: FileVault 2 Easily Decrypted
#10Actually this applies to "all" other similar encryption technologies and is not limited to mac or firewire. You can also use Thunderbolt, PCMCIA, ExpressCard and even esata ports to have direct access to a computers RAM in which you passphrase is being held. Basically all ports which use DMA are possible if I remember correctly. Further reading: http://en.wikipedia.org/wiki/DMA_attack
Basically the only "defense" is to shut your computer down when you're leaving it alone / unattended for some time.
I thought things had been like this for a while now. A year ago Wired magazine had a good article about a guy who ran a site buying and selling credit card details and law enforcements attempts to catch him.
The computer had full disk encryption which they couldn't touch. Instead they needed to raid the guys house when the computer was on and secure it so the techs could pull what they needed from memory.
I didn't think it could be done in under an hour though.