5 ms·
As the site says, OS X is mostly safe by default. DMA is disabled when a machine is locked or the user is not logged in[1], in OS X 10.7.2+. [1] https://suppo
by bjustin 14y ago
As the site says, OS X is mostly safe by default. DMA is disabled when a machine is locked or the user is not logged in[1], in OS X 10.7.2+.
[1] https://support.apple.com/kb/HT5002 https://support.apple.com/kb/HT5002
(missed the note about this on the page the first time through, but I'm leaving this for others who may have missed it)
- pyre 14y agoI'm curious, would this be possible in Linux? What would the kernel <-> {xscreensaver,gdm,lightdm,gnome-screensaver,etc} communication work like? How would the pathway be secure from an attacker just turning DMA back on? How does this work in OSX if a Firewire device is in the middle of a DMA operation when the OS is locked? Does the operation fail? Does the user lose data?
- TheAmazingIdiot 14y agoI just removed the module from loading. I dont have any firewire stuff anyways, so it's just some useless 4 pin port at the bottom left of my thinkpad. No driver, no workey.
- pyre 14y agoRight, but that's not what OSX is apparently doing. It's just limiting DMA operations under specific conditions. I'm wondering what that functionality would look like if implemented in Linux.
- tjoff 14y agoI've disabled it in BIOS (didn't find the option on my thinkpad though). It was a bit frustrating though when I, years later, tried to use a firewire media source and had forgotten that I had disabled it :\
- stcredzero 14y agoThe correct way to implement it would be to prevent the initiation of DMA operations when the device is locked, but to let current ones continue. I have no idea if that's what happened, though.
- pyre 14y agoI'm unsure how the DMA operations are structured though. A single 'operation' from the user's perspective might involve multiple operations at a lower level where locking in the middle might allow a single low-level atomic (in-progress) operation to complete, but the overall job to fail.
- stcredzero 14y ago> DMA is disabled when a machine is locked For Firewire. What about for Thunderbolt?
- jlgreco 14y agoDoes thunderbolt always use DMA? Perhaps if it's just being used as a screen output then it can turn DMA off but still work.
- X-Istence 14y agoThis was asked on Reddit, and the answer was yes ... http://www.reddit.com/r/netsec/comments/15ydem/inception_is_a_tool_for_using_firewire_to/c7qy7k9 http://www.reddit.com/r/netsec/comments/15ydem/inception_is_...
- bdash 14y agoAnother post[1] on the same website suggests that DMA is also disabled for Thunderbolt when the machine is locked. [1]: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/ http://www.breaknenter.org/2012/02/adventures-with-daisy-in-...
- stcredzero 14y agoIt's still slightly problematic for me. To prevent the re-activation of DMA, I have to disable the Guest account. Unfortunately, this also disables the "Find My iPhone" application. I would like to have both. Is there a way to have the Guest account, but not let people log into it when the machine is locked? EDIT: Got it. It reactivates the Guest user when you turn on the "Find My" feature, but you can deactivate Guest user afterwards.
- duskwuff 14y agoNote that this isn't necessary. If you have full disk encryption enabled, the machine will reboot (to a limited OS) when the Guest account is requested.