PC LOAD LETTER
4th January 2013, 18:01
Looks like if you utilize full disk encryption, you'll need to disable firewire. On Linux it looks like a grsec setting will protect you, though I'm not sure of the details - my system doesn't have firewire so I don't feel like looking into it.
http://www.breaknenter.org/projects/inception/?mwh=1
Inception is a FireWire physical memory manipulation and hacking tool exploiting IEEE 1394 SBP-2 DMA. The tool can unlock (any password accepted) and escalate privileges to Administrator/root on almost* any machine you have physical access to. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe interfaces.
Inception aims to provide a stable and easy way of performing intrusive and non-intrusive memory hacks on live computers using FireWire SBP-2 (http://en.wikipedia.org/wiki/Serial_Bus_Protocol_2) DMA (http://en.wikipedia.org/wiki/Direct_memory_access). It is primarily intended to do its magic against computers that utilize full disk encryption such as BitLocker, FileVault, TrueCrypt or Pointsec. There are plenty of other ways to hack a machine that doesn’t pack encryption. Inception is also useful for incident response teams and digital forensics experts when faced with live machines.
Inception’s main mode works as follows: By presenting a Serial Bus Protocol 2 (SBP-2) (http://en.wikipedia.org/wiki/Serial_Bus_Protocol_2) unit directory to the victim machine over the IEEE1394 FireWire interface, the victim operating system thinks that a SBP-2 device has connected to the FireWire port. Since SBP-2 devices utilize Direct Memory Access (DMA) (http://en.wikipedia.org/wiki/Direct_memory_access) for fast, large bulk data transfers (e.g., FireWire hard drives and digital camcorders), the victim lowers its shields and enables DMA for the device. The tool now has full read/write access to the lower 4GB of RAM on the victim. Once DMA is granted, the tool proceeds to search through available memory pages for signatures at certain offsets in the operating system’s password authentication modules. Once found, the tool short circuits the code that is triggered if an incorrect password is entered.
More info on protecting yourself from the tool's creator:
http://www.reddit.com/r/netsec/comments/11dhke/inception_020_released_supports_dmaunlocking/c6lmab1
Thanks for all the Reddit love my friends! Hit me up with questions on Twitter (https://twitter.com/breakNenter)
To stay safe and protect against FireWire DMA attacks, here's a couple of suggestions:
Windows
Block the SBP-2 driver (http://support.microsoft.com/kb/2516445)
Remove FireWire drivers from your system if you don't need to user FireWire
OS X
Don't panic - if you are using FileVault2 and OS X Lion (10.7.2) and higher, the OS will automatically turn off DMA when locked - you're still vulnerable to attacks when unlocked, though
Set a firmware password (http://ilostmynotes.blogspot.com/2012/01/os-x-open-firmware-settings-use-nvram.html)
Linux
Disable DMA or remove the 1394 drivers (http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation) (see the 'Mitigation: Linux' section)
All of the above will impact FireWire in one way or the other. Unfortunately, this is a FireWire design problem, not an OS problem, and would have to be fixed in the SBP-2 protocol itself. DMA is good for speed, bad for security.
http://www.breaknenter.org/projects/inception/?mwh=1
Inception is a FireWire physical memory manipulation and hacking tool exploiting IEEE 1394 SBP-2 DMA. The tool can unlock (any password accepted) and escalate privileges to Administrator/root on almost* any machine you have physical access to. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe interfaces.
Inception aims to provide a stable and easy way of performing intrusive and non-intrusive memory hacks on live computers using FireWire SBP-2 (http://en.wikipedia.org/wiki/Serial_Bus_Protocol_2) DMA (http://en.wikipedia.org/wiki/Direct_memory_access). It is primarily intended to do its magic against computers that utilize full disk encryption such as BitLocker, FileVault, TrueCrypt or Pointsec. There are plenty of other ways to hack a machine that doesn’t pack encryption. Inception is also useful for incident response teams and digital forensics experts when faced with live machines.
Inception’s main mode works as follows: By presenting a Serial Bus Protocol 2 (SBP-2) (http://en.wikipedia.org/wiki/Serial_Bus_Protocol_2) unit directory to the victim machine over the IEEE1394 FireWire interface, the victim operating system thinks that a SBP-2 device has connected to the FireWire port. Since SBP-2 devices utilize Direct Memory Access (DMA) (http://en.wikipedia.org/wiki/Direct_memory_access) for fast, large bulk data transfers (e.g., FireWire hard drives and digital camcorders), the victim lowers its shields and enables DMA for the device. The tool now has full read/write access to the lower 4GB of RAM on the victim. Once DMA is granted, the tool proceeds to search through available memory pages for signatures at certain offsets in the operating system’s password authentication modules. Once found, the tool short circuits the code that is triggered if an incorrect password is entered.
More info on protecting yourself from the tool's creator:
http://www.reddit.com/r/netsec/comments/11dhke/inception_020_released_supports_dmaunlocking/c6lmab1
Thanks for all the Reddit love my friends! Hit me up with questions on Twitter (https://twitter.com/breakNenter)
To stay safe and protect against FireWire DMA attacks, here's a couple of suggestions:
Windows
Block the SBP-2 driver (http://support.microsoft.com/kb/2516445)
Remove FireWire drivers from your system if you don't need to user FireWire
OS X
Don't panic - if you are using FileVault2 and OS X Lion (10.7.2) and higher, the OS will automatically turn off DMA when locked - you're still vulnerable to attacks when unlocked, though
Set a firmware password (http://ilostmynotes.blogspot.com/2012/01/os-x-open-firmware-settings-use-nvram.html)
Linux
Disable DMA or remove the 1394 drivers (http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation) (see the 'Mitigation: Linux' section)
All of the above will impact FireWire in one way or the other. Unfortunately, this is a FireWire design problem, not an OS problem, and would have to be fixed in the SBP-2 protocol itself. DMA is good for speed, bad for security.