Timeline for What are the potential risks of leaving a device in public, but locked?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 3, 2020 at 9:15 | comment | added | forest | @SteveSether Know that the majority of modern operating systems block DMA attacks with DMAR, though there are often ways around it (e.g. ndss-symposium.org/wp-content/uploads/2019/02/…). | |
| Jan 3, 2020 at 8:44 | comment | added | forest | @SteveSether Look for any FPGA PCIe card. You'll be able to use a PCIe IP core. It's not a simple "anyone can use it plug-n-play". You need to tailor it to your target, or at least to their OS and version. There are easy plug-n-play ones but I believe they are sold at extremely marked up prices to law enforcement (since they rarely have the skills to do it themselves). For an academic example (actually, one of the first), look up the paper on "Tribble" (yes, as in "Trouble with Tribbles" from Star Trek). | |
| Jan 2, 2020 at 15:32 | comment | added | Steve Sether | @RussellMcMahon A similar result can be achieved with a technology invented 1 million years ago. It's called a rock. | |
| Jan 2, 2020 at 15:17 | comment | added | Steve Sether | @forest Where can you buy such a device to copy the whole memory of the laptop? | |
| Jan 1, 2020 at 20:40 | comment | added | schlenk | USB 4.0 will allow DMA like Thunderbolt/Firewire... | |
| Jan 1, 2020 at 12:13 | comment | added | forest | Small nitpick for this answer, but PCI (as opposed to PCIe) does not support hotplugging unless you're using server motherboards with special hardware, so even if you did find a laptop with PCI, you wouldn't have to worry about hotplugging as a vector for DMA attack. And yes, hardware like this is commercially available (but it's probably better to build it yourself, which isn't that hard... just buy a cheap PCIe FPGA and program it to do DMA reads and dump that over USB or even serial, if you have the time). | |
| Jan 1, 2020 at 12:11 | comment | added | forest | @MarcusMüller For Windows 7 at least, Firewire DMA is disabled when the lock screen is active. I'm not sure about other external DMA-capable devices. Of course, if you can open the laptop quickly, PCIe hotplugging will let you get access to most system memory, assuming DMAR is not configured (not sure if Windows configures it by default. I think MacOS does, but not very well, and Linux only if you tell it to). | |
| Jan 1, 2020 at 8:22 | comment | added | Russell McMahon | ... 5V MAY be isolated from other supplies but PROBABLY connects to a 5V supply serving other areas. - possibly via filtering and probably via electronics (handshake, current limit, ...). Apply say 2 kV at as many Joules as I care to carry and the chances of a system not designed to resist resisting is small. | |
| Jan 1, 2020 at 8:22 | comment | added | Russell McMahon | @Steve Give me access to ground and one somewhat-isolated-from-ground connection and (should I wish it (I don't)) your device is toast. If you can get high energy and voltage into any node connecting to "silicon" that is not isolated and clamped by design to withstand an immense energy surge then, once it gets a foothold in an IC that is loosely connected by power supply rails and buses and .... , the energy is liable to end up 'anywhere'. || eg only - USB +5V and -ve. -ve essentially ground (probably). ... | |
| Dec 31, 2019 at 22:20 | comment | added | Marcus Müller | Not many laptops these days have firewire with unrestricted DMA; PCIe over thunderbolt, I think, is restricted by default until the OS tells the thunderbolt PCIe switch to do its thing. Leaves us with ExpressCard as the attack vector! | |
| Dec 31, 2019 at 19:19 | history | answered | Steve Sether | CC BY-SA 4.0 |