3 ms·

I am continually perplexed at how hardware designers end up with these kinds of "features" on external ports. Remember direct DMA attacks on FireWire, etc.? S

by payne92 10y ago

I am continually perplexed at how hardware designers end up with these kinds of "features" on external ports. Remember direct DMA attacks on FireWire, etc.? SMH.

yuhong 10y ago
The fun thing is that it is probably a very useful feature for those who know how to use it. You can debug your BIOS this way for example.
- viraptor 10y ago
  Sure, but you should disable it before shipping the final version. It's the same with programming microcontrollers - you have full read write and debug available. But you should really flip the right fuses to disallow changes in the shipped product.
andreyf 10y ago
I'd be curious to see a list of devices which ship with this enabled. I imagine it's shorter than the article makes it sound. I imagine DMA was a trade-off for speed. Security is about such trade-offs.
- psybin 10y ago
  It's a common feature for very high speed writes in hardware, DMA in firewire and thunderbolt is no mistake.
Animats 10y ago
I tried to get that disabled in Linux. There's a register in the FireWire interface which sets the range of addresses into which external memory access requests can be made. By default, it was at 4GB, even on 64 bit systems. Setting it to zero would break some external kernel debugger, though, so it was left open. (Firewire isn't DMA. PCI-E is DMA. Firewire is a network cable, over which software sends packets. LAN over FireWire was sometimes done. But there's an optional feature which recognizes special packets for doing word-size loads and stores. This is usually used to talk to dumb slave devices, where you write "registers" to make things happen. It's not needed on a computer, and it's far too slow for bulk transfers. FireWire isn't inherently more vulnerable than a LAN port.)
- psybin 10y ago
  Firewire in most setups allows DMA access to the host, but only to the first 32 bits of RAM. There's tools for unlocking, reading out keys from memory while asleep, all sorts of nasties.
  - Animats 10y ago
    In Linux, that's a constant in the Linux driver.
- kalleboo 10y ago
  IIRC Apple's "fix" was to just disable recognition of new FireWire devices when the computer was locked. So a nasty device could still compromise you, but it would be one that you plugged in yourself.
  - mikeash 10y ago
    It looks like your recollection is indeed correct. See the entry for CVE-2011-3215 here: https://support.apple.com/en-us/HT202348 https://support.apple.com/en-us/HT202348
deleted 10y ago
[deleted]

by payne92 10y ago

I am continually perplexed at how hardware designers end up with these kinds of "features" on external ports. Remember direct DMA attacks on FireWire, etc.? SMH.

yuhong 10y ago

The fun thing is that it is probably a very useful feature for those who know how to use it. You can debug your BIOS this way for example.

viraptor 10y ago
Sure, but you should disable it before shipping the final version. It's the same with programming microcontrollers - you have full read write and debug available. But you should really flip the right fuses to disallow changes in the shipped product.

andreyf 10y ago

I'd be curious to see a list of devices which ship with this enabled. I imagine it's shorter than the article makes it sound. I imagine DMA was a trade-off for speed. Security is about such trade-offs.

psybin 10y ago
It's a common feature for very high speed writes in hardware, DMA in firewire and thunderbolt is no mistake.

Animats 10y ago

I tried to get that disabled in Linux. There's a register in the FireWire interface which sets the range of addresses into which external memory access requests can be made. By default, it was at 4GB, even on 64 bit systems. Setting it to zero would break some external kernel debugger, though, so it was left open. (Firewire isn't DMA. PCI-E is DMA. Firewire is a network cable, over which software sends packets. LAN over FireWire was sometimes done. But there's an optional feature which recognizes special packets for doing word-size loads and stores. This is usually used to talk to dumb slave devices, where you write "registers" to make things happen. It's not needed on a computer, and it's far too slow for bulk transfers. FireWire isn't inherently more vulnerable than a LAN port.)

psybin 10y ago
Firewire in most setups allows DMA access to the host, but only to the first 32 bits of RAM. There's tools for unlocking, reading out keys from memory while asleep, all sorts of nasties.
- Animats 10y ago
  In Linux, that's a constant in the Linux driver.
kalleboo 10y ago
IIRC Apple's "fix" was to just disable recognition of new FireWire devices when the computer was locked. So a nasty device could still compromise you, but it would be one that you plugged in yourself.
- mikeash 10y ago
  It looks like your recollection is indeed correct. See the entry for CVE-2011-3215 here: https://support.apple.com/en-us/HT202348 https://support.apple.com/en-us/HT202348

deleted 10y ago

[deleted]