4 ms·
I thought this was a hardware-based attack. Does it matter whether the OS supports firewire or not?
by enneff 15y ago
I thought this was a hardware-based attack. Does it matter whether the OS supports firewire or not?
- loeg 15y agoNo. It's direct DMA from the hardware.
- calloc 15y agoIt does matter. The OS has to set up the device for DMA in the first place. If the device is never enumerated it just doesn't get access.
- jensnockert 15y agoWithout the driver, Firewire DMA is not enabled, so yes, it does matter. It is mentioned in the article. Lion even disables Firewire DMA when the screen is locked if you are running Filevault, or if you have an EFI password.
- Sanddancer 15y agoYes it does matter, as the OS has to set up the DMA channels, etc.
- rinkhals 15y agohttp://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f... "We have successfully tested that after unloading AppleFWOHCI.kext the current tools won't work anymore." If that's true then an option for those who need to use FW/TB devices is to remove the drivers from the system folder to prevent loading at startup and kextload/kextunload on demand. The following named drivers are present in "/System/Library/Extensions/" : IOFireWireAVC.kext IOFireWireFamily.kext //(The AppleFWOHCI.kext mentioned above is included here) IOFireWireIP.kext IOFireWireSBP2.kext IOFireWireSerialBusProtocolTransport.kext IOThunderboltFamily.kext AppleThunderboltDPAdapters.kext AppleThunderboltEDMService.kext AppleThunderboltNHI.kext AppleThunderboltPCIAdapters.kext AppleThunderboltUTDM.kext