[Full-disclosure] Firewire Attack on Windows Vista
echo6_uk at yahoo.com
Sun Mar 9 14:42:00 GMT 2008
-----BEGIN PGP SIGNED MESSAGE-----
Interesting thread, I'll come at it from a different perspective.
Computer forensics and incident response also has an application for
gaining access to physical memory. Discovering encryption keys from
memory and other volatile artifacts may be of use. In respect of
incident response how can you trust the OS environment on a compromised
machine? Are your traditional IR tools going to lie to you during live
analysis and data gathering process? Grabbing memory via firewire
minimizes this risk and also ensures least impact on the evidence.
OK Joanna Rutkowska has suggested a method to mitigate against these
attacks on AMD64 boxes
> you're better off in that situation. However, if the attacker
> anticipates this, he could simply power the system on, get the
> come-out-of-hibernation login prompt, compromise the kernel by injecting
> a driver or some such thing with a FireWire Memory attack, and then send
> it back into hibernate or something along those lines and wait for the
> real user to log in.
As you have rightly pointed out grabbing memory isn't the only nefarious
activity, if I can login to a target machine then I can deploy all
sorts of nasties. Could I use firewire to inject a process similar to a
dll injection attack?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
Full-Disclosure is hosted and sponsored by Secunia.