full-disclosure - Re: Firewire Attack on Windows Vista

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 09 Mar 2008 14:42:00 +0000
From: echo6 <echo6_uk@...oo.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Firewire Attack on Windows Vista

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Interesting thread, I'll come at it from a different perspective.

Computer forensics and incident response also has an application for
gaining access to physical memory.  Discovering encryption keys from
memory and other volatile artifacts may be of use.  In respect of
incident response how can you trust the OS environment on a compromised
machine?  Are your traditional IR tools going to lie to you during live
analysis and data gathering process?  Grabbing memory via firewire
minimizes this risk and also ensures least impact on the evidence.

OK Joanna Rutkowska has suggested a method to mitigate against these
attacks on AMD64 boxes
http://invisiblethings.org/papers/cheating-hardware-memory-acquisition-updated.ppt

> you're better off in that situation.  However, if the attacker
> anticipates this, he could simply power the system on, get the
> come-out-of-hibernation login prompt, compromise the kernel by injecting
> a driver or some such thing with a FireWire Memory attack, and then send
> it back into hibernate or something along those lines and wait for the
> real user to log in.

As you have rightly pointed out grabbing memory isn't the only nefarious
activity,  if I can login to a target machine then I can deploy all
sorts of nasties.  Could I use firewire to inject a process similar to a
dll injection attack?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFH0/c4bSv1saVS9ucRAorAAKCccsdD3FLzr+GFxe20nBRxgG5QXACbBzFq
1lwZKauGf3O3jXwtREUbmdE=
=0yLw
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/