Re: Firewire Attack on Windows Vista



On Wed, Mar 05, 2008 at 04:30:35PM -0500, Roger A. Grimes wrote:
As somewhat indicated in the paper itself, these types of physical DMA attacks are possible against any PC-based OS, not just Windows. If that's true, why is the paper titled around Windows Vista?

I guess it makes headlines faster. But isn't as important, if not more important, to say all PC-based systems have the same underlying problem? That it's a broader problem needing a broader solution, instead of picking on one OS vendor to get headlines?

Roger, you should note that Adam's "Hit by a Bus" paper includes information
about how Linux users can load their OS' Firewire driver in a way that should
disallow physical memory DMA access, and close this attack vector. I have not
yet seen anyone explain how to do the same in Windows. If there is no such
option in Windows (as the Panholzer paper claims), then Microsoft deserves
the negative attention.

[Disclaimer: I'm a full-time Microsoft employee.]

As for "broader solutions", Microsoft is in an excellent position to help
improve the situation -- maybe you could shed some light on their efforts?

-Peter



Relevant Pages

  • Re: [Full-disclosure] Firewire Attack on Windows Vista
    ... about how Linux users can load their OS' Firewire driver in a way that should ... yet seen anyone explain how to do the same in Windows. ... option in Windows, then Microsoft deserves ...
    (Full-Disclosure)
  • Re: Linux, X, ld, gcc, linking, shared libraries and stuff
    ... which is similar to "lazy binding"...but goodness knows what linker ... way of the "paging mechanism" to only load those pages which are actually ... > patch the pointer thereafter (i.e., dynamic linking). ... mechanism _IS_ there with Windows (though, ...
    (alt.lang.asm)
  • Re: Slow windows xp startup
    ... do you know how/have tried to boot into safemode? ... >> here is a copy of the Microsoft KB article for a clean boot in winxp: ... >> conflicts when you start Microsoft Windows XP. ... >> File, Process WIn.ini File, and Load Startup Items check boxes. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Studying abroad, devastating weird laptop problem
    ... - Normal Mode, Safe Mode with Networking, etc.), but no Safe Mode works ... load but it quickly slows down to a crawl, and takes about a minute to ... After this, Windows Calendar ... I've tried several things but I haven't had any success. ...
    (microsoft.public.windows.vista.general)
  • Re: memory reading and writing
    ... And, of course, during the boot process, it's mostly ... Plus, remember that Windows uses "on demand" loading...hence, an ... This conspires to mean that once initialisation is run (which is ... "avoiding" to load things until strictly necessary... ...
    (alt.lang.asm)