bugtraq - Re: [Full-disclosure] Firewire Attack on Windows Vista

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080308225100.GB2578@sentinelchicken.org>
Date: Sat, 8 Mar 2008 14:51:00 -0800
From: Tim <tim-security@...tinelchicken.org>
To: Larry Seltzer <Larry@...ryseltzer.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: [Full-disclosure] Firewire Attack on Windows Vista

> Yeah, I made specific reference to that attack in my message. There's a
> big difference between sleep mode and hibernate mode. In hibernate the
> system is powered off. Even if the memory has some residual charge I'm
> sure it's far less reliable than with sleep. 

Yeah, but the whole point is if it's written to disk, the data is much
easier to get at.  The hard thing to do is steal memory.  I've read that
some HD encryption systems encrypt the hibernate file too, so perhaps
you're better off in that situation.  However, if the attacker
anticipates this, he could simply power the system on, get the
come-out-of-hibernation login prompt, compromise the kernel by injecting
a driver or some such thing with a FireWire Memory attack, and then send
it back into hibernate or something along those lines and wait for the
real user to log in.

I can't say that I keep up on the particulars of how Windows does this
or that or the other related to hibernation and encryption, so perhaps
the specific attack above is flawed, but if you get to physical memory
and it's game over.  Doesn't matter what you do with obfuscation around
encryption.

tim