full-disclosure - Re: Firewire Attack on Windows Vista

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080305193745.A25582@gwyn.tux.org>
Date: Wed, 5 Mar 2008 19:37:45 -0500
From: Peter Watkins <peterw@....net>
To: "Roger A. Grimes" <roger@...neretcs.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>,
	Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Firewire Attack on Windows Vista

On Wed, Mar 05, 2008 at 04:30:35PM -0500, Roger A. Grimes wrote:
> As somewhat indicated in the paper itself, these types of physical DMA attacks are possible against any PC-based OS, not just Windows. If that's true, why is the paper titled around Windows Vista?
> 
> I guess it makes headlines faster.  But isn't as important, if not more important, to say all PC-based systems have the same underlying problem?  That it's a broader problem needing a broader solution, instead of picking on one OS vendor to get headlines?

Roger, you should note that Adam's "Hit by a Bus" paper includes information
about how Linux users can load their OS' Firewire driver in a way that should
disallow physical memory DMA access, and close this attack vector. I have not
yet seen anyone explain how to do the same in Windows. If there is no such
option in Windows (as the Panholzer paper claims), then Microsoft deserves 
the negative attention.

> [Disclaimer: I'm a full-time Microsoft employee.] 

As for "broader solutions", Microsoft is in an excellent position to help
improve the situation -- maybe you could shed some light on their efforts?

-Peter

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/