Re: Firewire Attack on Windows Vista

On Thu, 6 Mar 2008, Roger A. Grimes wrote:
> As somewhat indicated in the paper itself, these types of physical
> DMA attacks are possible against any PC-based OS, not just Windows.
> If that's true, why is the paper titled around Windows Vista?
>
> I guess it makes headlines faster. But isn't as important, if not
> more important, to say all PC-based systems have the same underlying
> problem? That it's a broader problem needing a broader solution,
> instead of picking on one OS vendor to get headlines?

Well it IS a new kid on the block, other systems have already had this
problem reported.. It would certainly be more interesting if Vista
wasn't vulnerable though :)

That said, according to the fwohci source in FreeBSD you have to
explicitly enable this feature and the fwohci man page says it is
mandatory for SBP. It would not be too difficult to disable it by
default unless and SBP device is in use. Even in that case it is
apparently possible to limit the access granted to a particular device
(eg only allow it for the places you expect the device to write to).

-- 
Daniel O'Connor software and network engineer
for Genesis Software - http://www.gsoft.com.au
"The nice thing about standards is that there
are so many of them to choose from."
  -- Andrew Tanenbaum
GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/