3 ms·
Is there any way to get around this? If so, is it implemented in any OS? I'm no encryption expert, but it seems like you would need to store decryption keys (o
by masnick 15y ago
Is there any way to get around this? If so, is it implemented in any OS?
I'm no encryption expert, but it seems like you would need to store decryption keys (or in this case, the login password) in plaintext so they could be used by the OS.
An explanation from an expert would be appreciated.
- ConstantineXVI 15y agoGiven that FireWire gives you direct, unsecured access to memory, the most secure solution would be to fill your FireWire port (as well as any other interface that has direct memory access, such as ExpressCard or Thunderbolt) with glue or otherwise render it unusable.
- masklinn 15y ago> Given that FireWire gives you direct, unsecured access to memory FireWire asks for it, but in recent years CPUs have started implementing IOMMUs, which should be useable to "lie" to devices and sandbox DMA'd memory, preventing full memory access to even low level busses (such as FireWire or Thunderbolt)
- sciurus 15y agoOn linux you can remove the firewire driver temporarily with 'rmmod firewire_ohci' or permanently by adding 'blacklist firewire_ohci' to /etc/modprobe.d/blacklist.conf.
- zdw 15y agoTurning on the firmware password (Either EFI or Open Firmware on PPC machines) disables firewire DMA. This is a well known and common lockdown procedure for security focused Mac admins, especially as it also prevents booting off of alternate media.