6

Using Passware Forensic Toolkit you can extract the bitlocker key using live memory dumping through Firewire (either by using an existing Firewire port, or by inserting an pcmcia/expresscard firewire card). No need to logon to Windows there...

Source: http://www.securityfocus.com/archive/88/516661/30/0/threaded

So OS independently Firewire is dangerous.

Are there any "ports" that could be dangerous? Why is Firewire dangerous? How could it be disabled? How to defend against: "or by inserting an pcmcia/expresscard firewire card"

Improve this question

2 Answers 2

Reset to default
5

There is some information and many pointers on this page. The common idea is that Firewire allows DMA: the plugged device can read and write physical memory at will (this allows fast data transfer without clogging the CPU; it is very useful for hard disks and fast network interfaces). For Firewire, some mitigation can be achieved by removing or nerfing the Firewire support on the OS (most Firewire controller require the OS to do a bit of initialization job, and we remove that part -- but there could exist Firewire controllers which will accept device-initiated DMA even if the OS does nothing, so it is hard to know if actual protection is achieved that way).

PCMCIA/PC Card/CardBus/ExpressCard are successive names for a peripheral standard which is, basically, a PCI (or PCI Express) bus with safe hotplug. DMA is consubstantial to PCI, so there is little defense against an attacker who has physical access to such a port.

Generally speaking, if the attacker can physically access the machine, you are doomed.

Improve this answer
7
  • 4
    I was about to say this : "Generally speaking, if the attacker can physically access the machine, you are doomed." but you already did.
    – M'vy
    Sep 17, 2011 at 15:42
  • Yeah, I can have all sorts of fun on the universal serial bus, and the PS2 mouse/keyboard aren't much better. To be honest, only video output is half safe and that's only cause we mask things like passwords.
    – ewanm89
    Sep 17, 2011 at 16:51
  • 1
    USB and PS2 don't have these vulnerabilities in the standard, but of course there may and have been bugs in the software which could be exploited (e. g. blindly trusting the device name query not to return a malicious pointer).
    – Hendrik Brummermann
    Sep 17, 2011 at 19:05
  • @Hendrik: such a vulnerability has indeed been exploited in the case of the PlayStation 3: the "PS3 JailBreak" is a USB device which emulates a USB hub with several devices, one of which returning several distinct "names" in succession, exploiting a buffer overflow in the OS.
    – Thomas Pornin
    Sep 17, 2011 at 19:17
  • one only needs to emulate a keyboard to input any keystroke one wishes. So, <Alt+F2>cmd<return> format c&<return> y<alt+esc> 5 mins later, well you get the picture.
    – ewanm89
    Sep 17, 2011 at 22:55
2

See also the Thunderbolt technology from Apple and Intel.

Here are a couple of articles with details of security concerns:

http://erratasec.blogspot.com/2011/02/thunderbolt-introducing-new-way-to-hack.html

http://isc.sans.edu/diary.html?storyid=10456

As to how to avoid these risks: remove the hardware from the machine, or glue the slots closed, or use physical locks to protect the machine (being aware that locksport is popular and most locks are trivially easy to pick).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .