4 ms·

This is relatively old. I first recall seeing it a few years ago.

• jseliger 13y ago
  If so, why haven't Microsoft and Apple patched it?
  • SomeoneWeird 13y ago
    It's part of the FireWire spec, they can't.
    • __david__ 13y ago
      It has nothing to do with the firewire spec.
    • midas007 13y ago
      It's perfectly reasonable (if technically possible) for either the OS or a third-party "firewall" app to intercept dangerous requests and prompt the user to allow/deny them.
  • AaronFriel 13y ago
    It isn't a software issue - it's a hardware issue. FireWire and these other specifications require direct memory access. If you plug in a device and it emulates something that requests DMA from the hardware, your machine can be owned. The solution is an IO memory management unit with virtualized access to physical memory. I am not sure how you can actually enforce this to devices on the bus though.
    • nine_k 13y ago
      If it requires a driver (and it does), it is a software issue. Just having a FireWire port, without a driver, is not enough. So a sane OS should just not allow to initialize a DMA transfer from a newly attached device until a user with enough privilege allows it.
    • __david__ 13y ago
      The solution is easier than that: only open up the appropriate buffers to DMA. It doesn't need to be virtualized, it just needs to be bounds checked. Maybe I'm spoiled by good hardware, but when I wrote FireWire drivers for embedded systems, we didn't just open up DMA access to RAM willy-nilly. I honestly don't know enough about OHCI to know what the hardware setup is like, but I suspect it's just laziness.
  • amichal 13y ago
    OSX 10.7.2+ apparently disables DMA when using FileVault and a screen lock. See the article 'Attack mitigation - OSX'. Seems like a decent compromise.
  • MichaelGG 13y ago
    See for instance: http://support.microsoft.com/kb/2516445 http://support.microsoft.com/kb/2516445 It's a well known limitation/tradeoff. Newer machines might ditch DisplayPort for Thunderbolt, which will really suck. "The drawback of this mitigation is that external storage devices can no longer connect by using the 1394 port, and all PCI Express devices that are connected to the Thunderbolt port will not work. Because USB and eSATA are so prevalent, and because DisplayPort often works even when Thunderbolt is disabled, the adverse effect caused by these mitigations should be limited. "
  • haberman 13y ago
    From the article: > Attack Mitigation : OSX : Don’t panic – if you are using FileVault2 and OS X Lion (10.7.2) and higher, the OS will automatically turn off DMA when locked – you’re still vulnerable to attacks when unlocked, though So it sounds like Apple has patched it. You just have to make sure your machine is locked.
  • c0nsumer 13y ago
    On Windows there's no patching to do, since this is by design. If you want to close this potential hole you simply stop the Firewire DMA driver from loading, which is pretty easy to do via Group or Local Policy. Microsoft has an article on it here: http://support.microsoft.com/kb/2516445 http://support.microsoft.com/kb/2516445