full-disclosure - Re: Firewire Attack on Windows Vista

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 15 Mar 2008 17:30:08 +0100 (CET)
From: Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>
To: Erik Trulsson <ertr1013@...dent.uu.se>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>,
	Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Firewire Attack on Windows Vista

On Fri, 7 Mar 2008, Erik Trulsson wrote:

> I wonder what other expansion ports can allow such control over the host
> computer. What about SCSI (which Firewire is partly based on in some
> aspects)? Or eSATA?  Or PCMCIA/PCCard?

Good question.

SCSI: I do not think you can coax the HBA to let you access arbitrary 
parts of the host memory. You can probably do nasty things to other SCSI 
devices when you are attached to a shared bus.

eSATA: Probably quite safe, everything you have got is a point-to-point
connection to the HBA. I suppose the HBA will not allow you to mess with 
the host or with other devices.

PCMCIA/PCCard: Afaik you get a direct connection to the host bus: ISA for
PCMCIA/PCCard, PCI for CardBus and PCIe (or USB) for ExpressCard. If you
get a bus-mastering device inserted into such a slot, you can probably 
access the host memory (within the DMA address range) without much 
trouble.

> USB is probably safe.

B in USB stands for a bus. You could probably do some interesting tricks
when you find yourself attached to the same bus as a trusted device (like 
a keyboard).

-- 
Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
"For death is come up into our MS Windows(tm)..." \ 21th century edition /

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/