After reading libreboot FAQ i have some questions about USB 2.0 bus. There it is strongly recommended to use usb devices - USB network card and USB to SATA adapter (to connect HDD or SSD with it). The reason is the lack of DMA. But all specification on USB 2.0 says that is sucsesful support DMA.
This is my result of using USB 2.0 to SATA adapter with SSD:
So what level of security can gives USB 2.0 to SATA adapter? He can isolate data on storage from steal by DMA and SMM attack?
////////////////////////////////////////////////////////////////
There are many question about what I want, so i need to add some info and try to explain. This is some quote from libreboot FAQ:
about USB NIC:
"Ethernet NICs will typically run firmware inside, which is responsible for initializing the device internally. Theoretically, it could be configured to drop packets, or even modify them.
With proper IOMMU, it might be possible to mitigate the DMA-related issues. A USB NIC can also be used, which does not have DMA."
So this means that USB NIC, without IOMMU settings cant DMA? - i don't think so. Datasheet on ICH7 says, that inbuild controller USB 2.0 can and supported DMA. So whithout proper IOMMU for USB NIC, NIC have access to DMA and can stole and edit memory?
about USB to SATA adapter:
SSDs and HDDs are a special case, since they are persistent storage devices as well as computers.
Example attack that malicious firmware could do: substitute your SSH keys, allowing unauthorized remote access by an unknown adversary. Or maybe substitute your GPG keys. SATA drives can also have DMA (through the controller), which means that they could read from system memory; the drive can have its own hidden storage, theoretically, where it could read your LUKS keys and store them unencrypted for future retrieval by an adversary.
With proper IOMMU and use of USB instead of SATA, it might be possible to mitigate any DMA-related issues that could arise.
With USB to SATA adapter same question. How much can I reduce the attack surface using USB without proper IOMMU? SSD is contain powerfull ARM and proprietary closed firmware, that can do some evil, and some one think that using USB insted SATA can protect from this.
Maybe someone can recommend other way to protect data on storage from steal!?
