12

Since Firewire lacks security, allowing a plugged-in device to access host memory, it's a good thing to fully disable it. If we're not using the BIOS to disable the Firewire port then how could we do it using "software methods"? The OS running on the PC is OpenBSD or Fedora or Ubuntu.

Edit: Is it sufficient to disable Firewire support in the operating system to prevent a Firewire attack device from accessing the memory? Which steps are required to prevent this kind of threat?

4 Answers 4

10

Software method:

  • Disable the Firewire driver / recompile kernel

Disabling the firewire driver prevents the use of any firewire device, as it disables the firewire hardware controller. In order for the attacks to work several requirements exist: The driver must be loaded so that the controller is initialised (bus-mastering etc), it must be configured to 'open-access' and not per-device, and dma must be enabled (ohci1394 had a disable dma option).

In Ubuntu firewire drivers are kernel modules. There is an easy way to blacklist them: Open /etc/modprobe.d/blacklist-firewire.conf, there you will find there a list of modules to be blacklisted.

blacklist ohci1394
blacklist sbp2
blacklist dv1394
blacklist raw1394
blacklist video1394
#blacklist firewire-ohci
#blacklist firewire-sbp2

Just remove the # in front of everything and save it. Then run sudo update-initramfs -k all -u

Other methods:

  • Disable the Firewire ports in BIOS
  • Seal the actual ports, as often done for USB ports in some environments.
2
  • 1
    Does merely disabling the driver prevent a Firewire device from accessing host memory? Jan 17, 2012 at 12:40
  • Disabling the firewire driver does indeed prevent the use of any firewire device, as it disables the firewire hardware controller. In order for the attacks to work several requirements exist: The driver must be loaded so that the controller is initialised (bus-mastering etc), it must be configured to 'open-access' and not per-device, and dma must be enabled (ohci1394 had a disable dma option)
    – john
    Jan 17, 2012 at 13:50
3

Compiling a custom kernel that lacks device support for the firewire interface should suffice. What prevents you from restricting access to those devices by permissions settings?

Removing the driver will prevent plugged-in devices from establishing DMA transfers:

1
1

OpenBSD doesn't supports Firewire by default:

https://en.wikipedia.org/wiki/Comparison_of_open_source_operating_systems#Supported_hardware

2
  • 3
    Yes, but how does that help? Will a computer running OpenBSD not be susceptible to attack from a Firewire device? Jan 17, 2012 at 12:42
  • a very good question... Jan 17, 2012 at 13:54
1

...you can also fine tune access to devices using /etc/fbtab

http://www.openbsd.org/cgi-bin/man.cgi?query=fbtab&sektion=5&apropos=0&manpath=OpenBSD+Current&arch=i386

based on a login through firewire/usb/other ports, everything can be disabled

1
  • Can you copy information from that link and edit it into your post? Links can get broken, which can make your post useless. Thanks!
    – Ohnana
    Sep 29, 2015 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .