3 ms·

Even worse than USB is Firewire, which, if I am not mistaken, gives direct memory access to whatever device is connected. However, manufacturers are already re

by jakobe 13y ago

Even worse than USB is Firewire, which, if I am not mistaken, gives direct memory access to whatever device is connected. However, manufacturers are already realising that blindly trusting every USB host is a bad idea. For example, iPhones now ask if you want to trust if you connect to a previously unknown computer via USB. If you chose not to, your iPhone will take power, but won't allow data access. Therefore it's no longer possible to create a device that looks like a charger but that actually downloads all the photos from your phone.

nwh 13y ago
> Even worse than USB is Firewire, which, if I am not mistaken, gives direct memory access to whatever device is connected. Both FireWire and Thunderbolt offer DMA. There's publicly available tools that allow you to extract passwords, remove lock screens and find keys in the memory of running devices using either type of port.
- phaer 13y ago
  Plus PCMCIA and ExpressCard, so most laptops are vulnerable out of the box[1], but there are some ways to mitigate those attacks. See https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack [1]...if you plug untrusted devices into your expansion slots or leave your laptop unattended.
  - sp332 13y ago
    My favorite FireWire hack was when a guy took a friend's laptop, which did not even have FireWire. He plugged in a FW card at the boot prompt. The computer auto-installed the driver, and the attack proceeded...
- jakobe 13y ago
  Here's a good article on vulnerabilities in Thunderbolt: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/ http://www.breaknenter.org/2012/02/adventures-with-daisy-in-... Turns out OS X 10.7 and later at least disable DMA access while the computer is locked (unless fast user switching is turned on).
cnvogel 13y ago
Yes, FireWire is bad in this regard, because it normally allows devices direct DMA to other devices memory space. This is also what makes/made it so popular for high-bandwidth/low-latency applications. But keep in mind that this is something that a host actually has to turn on for every single device on the bus[1], but probably most drivers are lazy and just unconditionally enable this globally. [1] See PhysicalRequestFilter in the OHCI specs http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/ohci_11.pdf http://download.microsoft.com/download/1/6/1/161ba512-40e2-4...

by jakobe 13y ago

nwh 13y ago

> Even worse than USB is Firewire, which, if I am not mistaken, gives direct memory access to whatever device is connected. Both FireWire and Thunderbolt offer DMA. There's publicly available tools that allow you to extract passwords, remove lock screens and find keys in the memory of running devices using either type of port.

phaer 13y ago
Plus PCMCIA and ExpressCard, so most laptops are vulnerable out of the box[1], but there are some ways to mitigate those attacks. See https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack [1]...if you plug untrusted devices into your expansion slots or leave your laptop unattended.
- sp332 13y ago
  My favorite FireWire hack was when a guy took a friend's laptop, which did not even have FireWire. He plugged in a FW card at the boot prompt. The computer auto-installed the driver, and the attack proceeded...
jakobe 13y ago
Here's a good article on vulnerabilities in Thunderbolt: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/ http://www.breaknenter.org/2012/02/adventures-with-daisy-in-... Turns out OS X 10.7 and later at least disable DMA access while the computer is locked (unless fast user switching is turned on).

cnvogel 13y ago

Yes, FireWire is bad in this regard, because it normally allows devices direct DMA to other devices memory space. This is also what makes/made it so popular for high-bandwidth/low-latency applications. But keep in mind that this is something that a host actually has to turn on for every single device on the bus[1], but probably most drivers are lazy and just unconditionally enable this globally. [1] See PhysicalRequestFilter in the OHCI specs http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/ohci_11.pdf http://download.microsoft.com/download/1/6/1/161ba512-40e2-4...