Re: Firewire Attack on Windows Vista

[echo6 <echo6_uk () yahoo com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Interesting thread, I'll come at it from a different perspective.

Computer forensics and incident response also has an application for
gaining access to physical memory.  Discovering encryption keys from
memory and other volatile artifacts may be of use.  In respect of
incident response how can you trust the OS environment on a compromised
machine?  Are your traditional IR tools going to lie to you during live
analysis and data gathering process?  Grabbing memory via firewire
minimizes this risk and also ensures least impact on the evidence.

OK Joanna Rutkowska has suggested a method to mitigate against these
attacks on AMD64 boxes
http://invisiblethings.org/papers/cheating-hardware-memory-acquisition-updated.ppt

> you're better off in that situation.  However, if the attacker
> anticipates this, he could simply power the system on, get the
> come-out-of-hibernation login prompt, compromise the kernel by injecting
> a driver or some such thing with a FireWire Memory attack, and then send
> it back into hibernate or something along those lines and wait for the
> real user to log in.

As you have rightly pointed out grabbing memory isn't the only nefarious
activity,  if I can login to a target machine then I can deploy all
sorts of nasties.  Could I use firewire to inject a process similar to a
dll injection attack?



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFH0/c4bSv1saVS9ucRAorAAKCccsdD3FLzr+GFxe20nBRxgG5QXACbBzFq
1lwZKauGf3O3jXwtREUbmdE=
=0yLw
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/