bugtraq - Re: Firewire Attack on Windows Vista

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <80F858A7121F403CB7F3F7B9B93194F9@localhost>
Date: Tue, 11 Mar 2008 23:55:42 +0100
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <bugtraq@...urityfocus.com>
Cc: "Steve Shockley" <steve.shockley@...ckley.net>
Subject: Re: Firewire Attack on Windows Vista

Steve Shockley wrote:

> Stefan Kanthak wrote:
>> 2. The typical user authentication won't help, we're at hardware
>> level here, and no OS needs to be involved.
> 
> So, if I understand you correctly, if I boot my machine into DOS the 
> memory can be read over Firewire?

If DMA is enabled on the firewire interface its possible!

If the BIOS allows to boot from a firewire device then it will setup
the hardware!

> Or does the machine need a Firewire driver loaded to be vulnerable?

If the BIOS does not setup the firewire interface the some driver has
to do it. So: it depends.

You can also read the memory if you shut down but dont power off your
system. Typically drivers leave their devices in working condition.

Stefan