Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do it using "software methods"? The OS running on the PC is OpenBSD or Fedora or Ubuntu.

Edit: Is it sufficient to disable Firewire support in the operating system to prevent a Firewire attack device from accessing the memory? Which steps are required to prevent this kind of threat?

share|improve this question

4 Answers 4

Software method:

  • Disable the Firewire driver / recompile kernel

Disabling the firewire driver prevents the use of any firewire device, as it disables the firewire hardware controller. In order for the attacks to work several requirements exist: The driver must be loaded so that the controller is initialised (bus-mastering etc), it must be configured to 'open-access' and not per-device, and dma must be enabled (ohci1394 had a disable dma option).

In Ubuntu firewire drivers are kernel modules. There is an easy way to blacklist them: Open /etc/modprobe.d/blacklist-firewire.conf, there you will find there a list of modules to be blacklisted.

blacklist ohci1394
blacklist sbp2
blacklist dv1394
blacklist raw1394
blacklist video1394
#blacklist firewire-ohci
#blacklist firewire-sbp2

Just remove the # in front of everything and save it. Then run sudo update-initramfs -k all -u

Other methods:

  • Disable the Firewire ports in BIOS
  • Seal the actual ports, as often done for USB ports in some environments.
share|improve this answer
1  
Does merely disabling the driver prevent a Firewire device from accessing host memory? –  Gilles Jan 17 '12 at 12:40
    
Disabling the firewire driver does indeed prevent the use of any firewire device, as it disables the firewire hardware controller. In order for the attacks to work several requirements exist: The driver must be loaded so that the controller is initialised (bus-mastering etc), it must be configured to 'open-access' and not per-device, and dma must be enabled (ohci1394 had a disable dma option) –  john Jan 17 '12 at 13:50

Compiling a custom kernel that lacks device support for the firewire interface should suffice. What prevents you from restricting access to those devices by permissions settings?

Removing the driver will prevent plugged-in devices from establishing DMA transfers:

share|improve this answer
    
@Gilles Another resource stating the same: support.microsoft.com/kb/2516445. DMA isn't possible until code is run on the CPU to let it happen. –  Jeff Ferland Jan 17 '12 at 12:56
up vote 1 down vote accepted

OpenBSD doesn't supports Firewire by default:

https://en.wikipedia.org/wiki/Comparison_of_open_source_operating_systems#Supported_hardware

share|improve this answer
3  
Yes, but how does that help? Will a computer running OpenBSD not be susceptible to attack from a Firewire device? –  Gilles Jan 17 '12 at 12:42
    
a very good question... –  LanceBaynes Jan 17 '12 at 13:54

...you can also fine tune access to devices using /etc/fbtab

http://www.openbsd.org/cgi-bin/man.cgi?query=fbtab&sektion=5&apropos=0&manpath=OpenBSD+Current&arch=i386

based on a login through firewire/usb/other ports, everything can be disabled

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.