Re: [Full-disclosure] Firewire Attack on Windows Vista

On Fri, 07 Mar 2008 14:51:07 -0500, Larry Seltzer wrote:

Let's say the computer is off. You can turn it on, but that gets you
to a login screen. What can the Firewire device do?

OK, I guess I misunderstood the original paper
(http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks
.pdf). It now looks to me like they are claiming they can disable
password authentication *even while the system is not logged on* - do I
have that right?

Larry,

Are you familiar with ICE or JTAG debugging hardware?
ieee1394 is implemented by default in such a fashion that a ieee1394 port
can basically be used as a hardware debugger to memory. i.e. any ieee1394
device can poke/peek the entire _physical memory space_ of any other
device on the bus. With that capability you can do anything that could
be accomplished from the internals of the operating system.

The essential flaw here is that current SBP-2 drivers do not set up a
proper virtual memory map between the firewire chipset and the host, and
just expose the entire host's physical address space. Fixing this
requires reimplementing a good deal of design and buffering for the SBP-2
(that's the firewire SCSI block protocol) drivers.

I however, don't know enough about windows drivers and disk access to
elaborate from there about how hard that will be to fix in the windows
world.

What people seem to be missing is that this condition is *fixable*, but
the real impetus may not be there outside of folks from the Trusted
Computing crowd etc etc.

What points are you trying to stab at for an article?


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • 2.6.33 dies on modprobe
    ... The kernel starts up fine and mounts the root-filesystem, ... Freeing unused kernel memory: 408k freed ... # CPUFreq processor drivers ...
    (Linux-Kernel)
  • Re: s2disk hang update
    ... This looks like we have run out of memory while creating a new kernel thread ... because the I/O doesn't work at this point). ... Keep 1 MB of memory free so that device drivers can allocate some pages in ...
    (Linux-Kernel)
  • kernel panic - not syncing: out of memory and no killable processes
    ... Kernel panic - not syncing: Out of memory and no killable processes... ... Re-tune the scheduler latency defaults to decrease worst-case latencies ... # Device Drivers ...
    (Linux-Kernel)
  • Need help debugging memory corruption
    ... I'm trying to track down a memory corruption bug in the atl1 network ... Allocating PCI resources starting at d4000000 ... PCI: Scanning behind PCI bridge 0000:00:01.0, config 010100, pass 0 ... # CPUFreq processor drivers ...
    (Linux-Kernel)
  • Re: [GIT PULL v3] Early boot SLAB for 2.6.31
    ... Thread overran stack, or stack corrupted ... Scanning 0 areas for low memory corruption ... Virtual Wire compatibility mode. ... # AX.25 network device drivers ...
    (Linux-Kernel)