bugtraq - RE: [Full-disclosure] Firewire Attack on Windows Vista

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 7 Mar 2008 11:55:19 -0800
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "Larry Seltzer" <Larry@...ryseltzer.com>,
	"Bugtraq" <bugtraq@...urityfocus.com>,
	"Full Disclosure" <full-disclosure@...ts.grok.org.uk>
Subject: RE: [Full-disclosure] Firewire Attack on Windows Vista

The main point is to grab encryption keys from memory where the drive is
encrypted - but that has to be while the device is on.  I mean, it
doesn't really matter if you disable password auth when you have
physical access as you can just take the drive out, boot from CD, etc...

t

> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-
> disclosure-bounces@...ts.grok.org.uk] On Behalf Of Larry Seltzer
> Sent: Friday, March 07, 2008 11:51 AM
> To: Bugtraq; Full Disclosure
> Subject: Re: [Full-disclosure] Firewire Attack on Windows Vista
> 
> >>Let's say the computer is off. You can turn it on, but that gets you
> to a login screen. What can the Firewire device do?
> 
> OK, I guess I misunderstood the original paper
> (http://www.sec-
> consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks
> .pdf). It now looks to me like they are claiming they can disable
> password authentication *even while the system is not logged on* - do
I
> have that right?
> 
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blogs.pcmag.com/securitywatch/
> Contributing Editor, PC Magazine
> larry.seltzer@...fdavisenterprise.com
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/