News, info, and opinion by Mac users, for Mac users.

March 5, 2008

security

The Firewire direct memory access back door

Posted Mar. 5, ’08, 5:25 AM PT by Derik DeLong
Category | Security

Firewire Engadget is making famous a report that Firewire can be used to break into computers. One of Firewire’s features is that it allows for Direct Memory Access (DMA). Connect a Firewire device, including another computer and it can read and write to the memory, including the region where the password is stored.

This exploit isn’t limited just to Windows. The same thing can be done on Macs. The one advantage that we have is that turning on OpenFirmware password disables this direct memory access. However, these two reports are both dated and with Intel Macs using EFI instead of OpenFirmware, it’s unsure how one protects against this.

Before you get too worked up, this attack requires physical access. This may not reassure you, but think of it this way: anybody with physical access can use an OS install disc to reset the administrative password to get access to your computer (or just take the disk right out of your Mac). Now, if you’ll excuse me, I need to go put on my new tin foil hat.


2 Comments

Kelmon said:

Well, there was the expectation that, while someone can indeed reset your Admin account password using the OS X install disk (unless you are using a MacBook Air!), if your data was encrypted using FileVault then the attacker still gets nothing. However, given the other recently reported exploit that shows the password for FileVault is stored in RAM I can only assume that this attack would also get that as well. So rather than a tin foil hat, perhaps a brick wall would be a better idea? While we can flippant about such issues because the attacker needs physical access to your computer, this is a serious issue for those working in open environments like an office.

March 5, 2008 6:22 AM
fletcher Author Profile Page said:

This at least doesn't seem to require opening the case and then dismantling the MacBook.

Storing your password in RAM is one thing, but think of all the things you have stored in RAM at one moment or another. Your taxes, your spreadsheets, your email, your word processing documents, Web pages. Everything you do on the computer, whether it be confidential, secret, illegal, or just embarrassing is in RAM at one time.

Exploits which require the theft of my laptop are not a huge concern to me since I'm sure anyone who steals my laptop and is clever is going to be able to get to most of my data.

But, an exploit which allows someone to read my RAM simply by plugging in a FireWire cable strikes me as considerably more serious. Hopefully, we'll see a fix. Maybe a password prompt before DMA access is allowed for a device that is plugged in.

March 5, 2008 7:54 AM

Leave a comment

 



Visit other IDG sites: