My favorite FW exploit story: someone thought their laptop was "secure" because it didn't even have a FW port. The attacker plugged in a FW card at the login prompt, and the OS automatically installed the drivers - and the vulnerability :)
Thunderbolt-DMA-land: Hacking Macs through the Thunderbolt interface
21–25 of 25 posts
Re: Thunderbolt-DMA-land: Hacking Macs through the Thunderbolt interface
#22There are ways to prevent DMA over firewire, and also Apple has been aware of and provided prevention methods (such as disabling firewire DMA when a firmware password is enabled) over the years.
A good account of the current state of affairs is here:
http://derflounder.wordpress.com/2012/02/05/protecting-yours...
And a diagram of protection methods that do work:
http://www.frameloss.org/2011/09/18/firewire-attacks-against...
Re: Thunderbolt-DMA-land: Hacking Macs through the Thunderbolt interface
#23Earlier quoted context omitted.
I thought this was a hardware-based attack. Does it matter whether the OS supports firewire or not?
No. It's direct DMA from the hardware.
It does matter. The OS has to set up the device for DMA in the first place. If the device is never enumerated it just doesn't get access.
Re: Thunderbolt-DMA-land: Hacking Macs through the Thunderbolt interface
#24[deleted]
Re: Thunderbolt-DMA-land: Hacking Macs through the Thunderbolt interface
#25Funny, when I first heard about thunderbolt my first thought was "Cool, I can finally build my own SSI NUMA box like an SGI!".
The second thought was, gee, what if someone writes a crappy driver that scribbles another hosts memory.