Re: [Full-disclosure] Firewire Attack on Windows Vista
On Fri, 7 Mar 2008, Erik Trulsson wrote: I wonder what other expansion ports can allow such control over the host computer. What about SCSI (which Firewire is partly based on in some aspects)? Or eSATA? Or PCMCIA/PCCard? Good question. SCSI: I do not think you can coax the HBA to let you access arbitrary parts of the host memory. You can probably do nasty things to other SCSI devices when you are attached to a shared bus. eSATA: Probably quite safe, everything you have got is a point-to-point connection to the HBA. I suppose the HBA will not allow you to mess with the host or with other devices. PCMCIA/PCCard: Afaik you get a direct connection to the host bus: ISA for PCMCIA/PCCard, PCI for CardBus and PCIe (or USB) for ExpressCard. If you get a bus-mastering device inserted into such a slot, you can probably access the host memory (within the DMA address range) without much trouble. USB is probably safe. B in USB stands for a bus. You could probably do some interesting tricks when you find yourself attached to the same bus as a trusted device (like a keyboard). -- Pavel Kankovsky aka Peak / Jeremiah 9:21\ For death is come up into our MS Windows(tm)... \ 21th century edition / ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
How much should the average user worry about this? Not very much. Most notebooks from average users don't even have Firewire on them and you would have an easier time cracking them with a dictionary attack on the password and other such things, which means that this attack makes you no more vulnerable to compromise if you've already granted physical access than you were before. you don't need a firewire port on your laptop, a pcmcia slot is enough where an attacker inserts a firewire card. but still.. it's a physical access attack.. regarding your other email: OK, I guess I misunderstood the original paper (http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks .pdf). It now looks to me like they are claiming they can disable password authentication *even while the system is not logged on* - do I have that right? yes, if the system is off and you can turn it on (e.g. no bios or hdd encryption passwords) you can bypass the logon screen. this is because the tool searches for the function MsvpPasswordValidate in memory and patches it to allow any password. FD ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Re. where you said, yes, if the system is off and you can turn it on (e.g. no bios or hdd encryption passwords) you can bypass the logon screen. this is because the tool searches for the function MsvpPasswordValidate in memory and patches it to allow any password. That's correct, but not entirely. Yes, you can patch Winlogon to allow any password, but that does not necessarily mean you can access the user's data. #1, you will not be able to access any resources which are encrypted using Windows protected storage. This includes all EFS-protected files, as well as stored passwords for IE, Outlook, etc. All of these secrets are protected using keys which are derived from the user's credentials. Obviously if the system is unable to reconstruct these keys, then the protected data will be out of reach. (This would be true regardless of whether or not the logged-on account belongs to a domain.) #2, you will not be able to access network resources as the user. Again, this is because when the machine authenticates to remote resources, it does so by providing a proof which is calculated from the user's credentials. And again, without access to the user's credentials, the system won't be able to perform network authentication on the user's behalf. In a real-world scenario, as the attacker, I would prefer to install a Trojan in order to capture the user's credentials the next time they log on. - Eric -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of FD Sent: Monday, March 10, 2008 11:50 AM To: Larry Seltzer Cc: full-disclosure@lists.grok.org.uk; [EMAIL PROTECTED] Subject: Re: [Full-disclosure] Firewire Attack on Windows Vista How much should the average user worry about this? Not very much. Most notebooks from average users don't even have Firewire on them and you would have an easier time cracking them with a dictionary attack on the password and other such things, which means that this attack makes you no more vulnerable to compromise if you've already granted physical access than you were before. you don't need a firewire port on your laptop, a pcmcia slot is enough where an attacker inserts a firewire card. but still.. it's a physical access attack.. regarding your other email: OK, I guess I misunderstood the original paper (http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks .pdf). It now looks to me like they are claiming they can disable password authentication *even while the system is not logged on* - do I have that right? yes, if the system is off and you can turn it on (e.g. no bios or hdd encryption passwords) you can bypass the logon screen. this is because the tool searches for the function MsvpPasswordValidate in memory and patches it to allow any password. FD ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Hi, I am new to this list. I was reading your messages, and began to wonder; For a temporary fix action why not just disable the ability to install new firewire devices? I know that this does not fix the fundamental problem, but it could work as a decent kludge. I am reminded of the NSA Security Guide on Disabling USB Deviceshttp://www.nsa.gov/snac/support/I731-002R-2007.pdf, how do these actions translate to firewire? On Sun, Mar 9, 2008 at 11:35 PM, Jardel Weyrich [EMAIL PROTECTED] wrote: Larry, there is no disk involved on the problem, only memory. So if the disk is encrypted or not, doesn't matter. Regards, Jardel Weyrich On Sun, Mar 9, 2008 at 11:14 PM, Larry Seltzer [EMAIL PROTECTED] wrote: WRT the DMA access over FireWire it's but a bad response since it doesn't get the point! 1. Drive encryption won't help against reading the memory. 2. The typical user authentication won't help, we're at hardware level here, and no OS needs to be involved. 3. The computer is up (and running; see above), no hibernate or sleep is involved here. So on a freshly-booted system with drive encryption you can read whatever you want on the disk? 4. Group policies can be circumvented, even by a limited user. http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventi ng-group-policy-as-a-limited-user.aspxhttp://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx What he says is that some group policies, not including system-wide security settings, maybe circumvented, even by a limited user. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Larry Seltzer wrote: WRT the DMA access over FireWire it's but a bad response since it doesn't get the point! 1. Drive encryption won't help against reading the memory. 2. The typical user authentication won't help, we're at hardware level here, and no OS needs to be involved. 3. The computer is up (and running; see above), no hibernate or sleep is involved here. So on a freshly-booted system with drive encryption you can read whatever you want on the disk? No. As another poster already wrote: there's no(t yet a) disk involved. The attacker just reads the memory and can then try to find cached credentials or cryptographic keys (as described in the paper by Ed Felten et al). But let's take it further: Windows uses TCP/IP over IEEE 1394 in standard setup, so after getting the cached credentials of an Administrator from memory an attacker can successfully (I assume a standard setup where the Windows firewall allows accesses from the own subnet) mount \\target\C$ or \\target\ADMIN$ and thus read the files on the disk. If only drive encryption is used, the files are decrypted by the target. 4. Group policies can be circumvented, even by a limited user. http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventi ng-group-policy-as-a-limited-user.aspx What he says is that some group policies, not including system-wide security settings, maybe circumvented, even by a limited user. Right. The point is that group policies can/might help, but are not fool proof. Stefan Kanthak ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Interesting thread, I'll come at it from a different perspective. Computer forensics and incident response also has an application for gaining access to physical memory. Discovering encryption keys from memory and other volatile artifacts may be of use. In respect of incident response how can you trust the OS environment on a compromised machine? Are your traditional IR tools going to lie to you during live analysis and data gathering process? Grabbing memory via firewire minimizes this risk and also ensures least impact on the evidence. OK Joanna Rutkowska has suggested a method to mitigate against these attacks on AMD64 boxes http://invisiblethings.org/papers/cheating-hardware-memory-acquisition-updated.ppt you're better off in that situation. However, if the attacker anticipates this, he could simply power the system on, get the come-out-of-hibernation login prompt, compromise the kernel by injecting a driver or some such thing with a FireWire Memory attack, and then send it back into hibernate or something along those lines and wait for the real user to log in. As you have rightly pointed out grabbing memory isn't the only nefarious activity, if I can login to a target machine then I can deploy all sorts of nasties. Could I use firewire to inject a process similar to a dll injection attack? -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFH0/c4bSv1saVS9ucRAorAAKCccsdD3FLzr+GFxe20nBRxgG5QXACbBzFq 1lwZKauGf3O3jXwtREUbmdE= =0yLw -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
On Fri, Mar 07, 2008 at 02:44:12PM -0500, Larry Seltzer wrote: Let's say the computer is off. You can turn it on, but that gets you to a login screen. What can the Firewire device do? Just about anything it wants to. It uses DMA (Direct Memory Access) which can be initiated by any device on the Firewire bus. This means a device connected to the Firewire bus can read and/or modify any part of RAM of any other device connected to that bus. It can (at least in principle) modify the OS, and insert any number of viruses or other malware - or of course modify the login program so it lets anybody in. It is also very useful as a debug aid for developers, since one can inspect memory contents even if the OS has crashed completely. The only protection against this (other than to completely disable Firewire) is to program the Firewire controller in the computer to either not accept any DMA commands at all, or program it so it can only perform DMA to certain known, safe, memory areas. To what extent one can restrict the operations allowed for any given controller can probably vary between different chips, and if one restricts it too much, then some legitimate devices might stop working. I wonder what other expansion ports can allow such control over the host computer. What about SCSI (which Firewire is partly based on in some aspects)? Or eSATA? Or PCMCIA/PCCard? USB is probably safe. I think all operations must be initiated by the host computer when using USB. (USB is a much simpler and more stupid interface than Firewire. This is one reason why Firewire devices usually give perform better than equivalent USB devices, despite running at a lower nominal bitrate (400 Mbit/s for Firewire compared to 480 Mbit/s for USB.) -- Insert your favourite quote here. Erik Trulsson [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Larry Seltzer wrote: I actually do have a response fom Microsoft on the broader issue, but it doesn't address these issues or even concded that there's necessarily anything they can do about it. They instead speak of the same precautions for physical access that they spoke of a couple weeks ago with respect to the frozen notebook memory attack - use drive encryption, use 2-factor authentication, use hibernate instead of sleep, use group policy to enforce them. I don't think it's a bad response under the circumstances. WRT the DMA access over FireWire it's but a bad response since it doesn't get the point! 1. Drive encryption won't help against reading the memory. 2. The typical user authentication won't help, we're at hardware level here, and no OS needs to be involved. 3. The computer is up (and running; see above), no hibernate or sleep is involved here. 4. Group policies can be circumvented, even by a limited user. http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx Stefan ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
WRT the DMA access over FireWire it's but a bad response since it doesn't get the point! 1. Drive encryption won't help against reading the memory. 2. The typical user authentication won't help, we're at hardware level here, and no OS needs to be involved. 3. The computer is up (and running; see above), no hibernate or sleep is involved here. So on a freshly-booted system with drive encryption you can read whatever you want on the disk? 4. Group policies can be circumvented, even by a limited user. http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventi ng-group-policy-as-a-limited-user.aspx What he says is that some group policies, not including system-wide security settings, maybe circumvented, even by a limited user. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
You're mistaken in thinking that we're conflating sleep and hibernate modes. Microsoft's response of using two factor authentication is silly. It doesn't actually stop our attacks. In certain circumstances, it may shorten the window of attack for a specific type of user but it's mostly irrelevant. Consider a mail server with an encrypted drive, no proximity sensor or two factor authentication is going to help you. A seizure will still result in someone getting the keys that are in memory - unless you're using some sort of secure crypto co-processor (which no one is). From your own paper: Microsoft ... recommends configuring BitLocker in advanced mode, where it protects the disk key using the TPM along with a password or a key on a removable USB device. However, even with these measures, BitLocker is vulnerable if an attacker gets to the system while the screen is locked or the computer is asleep (though not if it is hibernating or powered off). So in other words, hibernate does make a difference, especially if you follow their guidelines. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Larry, there is no disk involved on the problem, only memory. So if the disk is encrypted or not, doesn't matter. Regards, Jardel Weyrich On Sun, Mar 9, 2008 at 11:14 PM, Larry Seltzer [EMAIL PROTECTED] wrote: WRT the DMA access over FireWire it's but a bad response since it doesn't get the point! 1. Drive encryption won't help against reading the memory. 2. The typical user authentication won't help, we're at hardware level here, and no OS needs to be involved. 3. The computer is up (and running; see above), no hibernate or sleep is involved here. So on a freshly-booted system with drive encryption you can read whatever you want on the disk? 4. Group policies can be circumvented, even by a limited user. http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventi ng-group-policy-as-a-limited-user.aspxhttp://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx What he says is that some group policies, not including system-wide security settings, maybe circumvented, even by a limited user. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
What points are you trying to stab at for an article? You've hit on them pretty well. My own experience with DMA programming was 20 years ago with real mode DOS drivers, but I was surprised to learn from this thread that a DMA mass storage device on Linux, Mac and Windows gets unimpeded access to the full stretch of system memory. I take what I read here with a grain of salt, but the non-nut cases seem to be out and in agreement, at least about that. I'm not going to be writing a 20 page paper. I think I have 2 main questions I'll write about: How much should you worry about this and is it fixable (beyond disabling DMA, which is not a good solution if you ask me). You say it's fixable; that still leaves some questions for me whether the fix comes at the expense just of additional sophistication in the Firewire drivers or also a performance burden. I'll probably just leave it at a question. I actually do have a response fom Microsoft on the broader issue, but it doesn't address these issues or even concded that there's necessarily anything they can do about it. They instead speak of the same precautions for physical access that they spoke of a couple weeks ago with respect to the frozen notebook memory attack - use drive encryption, use 2-factor authentication, use hibernate instead of sleep, use group policy to enforce them. I don't think it's a bad response under the circumstances. The fact that you can turn off DMA on Linux seems in fact inferior to simply disabling the Firewire port and driver at run-time in Windows. They both suck as solutions. Incidentally, Microsoft made a few other points in their response that were interesting, but raised more questions than they answered: * it's possible for a user to disable 1394 DMA. I'm still looking into how you can do this. * it's possible for a user to constrain a DMA device's memory access to specific ranges by using the physical DMA type. They say that some devices cannot be so restricted at all, and for others the restriction would only come at the cost of additional complexity and a performance hit, as I allude to above. I assume these considerations are generic to the hardware and not specific to Windows. How much should the average user worry about this? Not very much. Most notebooks from average users don't even have Firewire on them and you would have an easier time cracking them with a dictionary attack on the password and other such things, which means that this attack makes you no more vulnerable to compromise if you've already granted physical access than you were before. The frozen notebook memory attack seems a little too Mission Impossible for me to get worked up about. And if you're the sort of high-value target who needs to worrry about this sort of attack, there are measures you can take: use drive encryption, use 2-factor authentication, use hibernate instead of sleep, use group policy to enforce them. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Hi Larry, - use drive encryption, use 2-factor authentication, use hibernate instead of sleep, use group policy to enforce them. Uh... yeah. So how again does drive encryption help you against this attack? Certain forms of 2-factor auth might help you, but all of the kinds I've seen would still rely on encryption keys in memory to encrypt any sensitive data on the drive, not to mention the fact that writing to memory would still bypass that auth. The funniest is using hibernate... Did you perchance read: http://www.eff.org/press/archives/2008/02/21-0 ?? Once again MS treats a security issue as a PR issue. The fact that you can turn off DMA on Linux seems in fact inferior to simply disabling the Firewire port and driver at run-time in Windows. They both suck as solutions. How exactly is the Linux solution inferior? Not just trying to defend Linux and attack Windows here, but really I don't see how this statement is true, so you must not understand how it works. By disabling DMA, you're just disabling it for that one driver, not all drivers. In addition, you can load/unload driver modules at run-time typically. Incidentally, Microsoft made a few other points in their response that were interesting, but raised more questions than they answered: * it's possible for a user to disable 1394 DMA. I'm still looking into how you can do this. That would be interesting to find out. Please do tell if you figure out how this can be done. * it's possible for a user to constrain a DMA device's memory access to specific ranges by using the physical DMA type. They say that some devices cannot be so restricted at all, and for others the restriction would only come at the cost of additional complexity and a performance hit, as I allude to above. I assume these considerations are generic to the hardware and not specific to Windows. Ok, so they concede it is possible to limit the DMA accesses to specific (safe) ranges. I wonder which devices cannot be restricted... How much should the average user worry about this? Not very much. Yeah, I agree it's probably not a big risk right now. That may change over time though, as more and more small devices become very programmable. You can already hack Linux onto your iPod, which makes a great cover for casually compromizing machines in an office environment. The number of small devices which would normally seem benign to end users, but are capable of being quite evil, will only increas over time. Good luck with your article, tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
The funniest is using hibernate... Did you perchance read: http://www.eff.org/press/archives/2008/02/21-0 ?? Yeah, I made specific reference to that attack in my message. There's a big difference between sleep mode and hibernate mode. In hibernate the system is powered off. Even if the memory has some residual charge I'm sure it's far less reliable than with sleep. Everything I've seen in descriptions of that attack tells me they are unfairly conflating sleep and hibernate. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Yeah, I made specific reference to that attack in my message. There's a big difference between sleep mode and hibernate mode. In hibernate the system is powered off. Even if the memory has some residual charge I'm sure it's far less reliable than with sleep. Yeah, but the whole point is if it's written to disk, the data is much easier to get at. The hard thing to do is steal memory. I've read that some HD encryption systems encrypt the hibernate file too, so perhaps you're better off in that situation. However, if the attacker anticipates this, he could simply power the system on, get the come-out-of-hibernation login prompt, compromise the kernel by injecting a driver or some such thing with a FireWire Memory attack, and then send it back into hibernate or something along those lines and wait for the real user to log in. I can't say that I keep up on the particulars of how Windows does this or that or the other related to hibernation and encryption, so perhaps the specific attack above is flawed, but if you get to physical memory and it's game over. Doesn't matter what you do with obfuscation around encryption. tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
I made a short reply to this yesterday, but it probably came off as flippant and thus didn't get posted. However, if one insists on leaving their machine unattended in a public place, but have at least locked it, but are still worried that someone will use a hardware-based firewire attack, then just disable the host controller in the first place and be done with it. Or, if one is already using a firewire device, but has walked away and left their laptop alone in a public place along with that firewire device on and activated and are worried about someone coming along and plugging in their own in order to grab your Bitlocker key, then don't have autorun (which is default) automatically enabled for the device. Of course that won't stop someone of opening up the laptop with their handy-dandy Leatherman and using canned air turned upside down to freeze the memory chip, take it out, put it in their laptop, search for the key in memory, and then put it back in the other box to then steal the data. But more to Mr. Grimes original point, I actually don't mind seeing this put as a Vista attack, be it unpatched, or an attack against the activation mechanism, or whatever. If the Vista Firewire attack is what it takes for people to get into the news about Vista vulnerabilities, then I consider that a good thing. t -Original Message- From: Tim [mailto:[EMAIL PROTECTED] Sent: Thursday, March 06, 2008 12:00 PM To: Larry Seltzer Cc: Full Disclosure; Bugtraq Subject: Re: [Full-disclosure] Firewire Attack on Windows Vista What are the implications for firewire device compatibility of doing this? I am no expert on ieee1394, but I have read up a bit on this and tested Metlstorm's memory dumping tool and here's what I understand: Firewire chipsets allow drivers to configure a particular memory range which is open to access by DMA devices. Since the memory transfers occur completely without software intervention, the only way to restrict this is to tell the chip ahead of time what to allow and what not to allow. Before these tools came out, most free OSes simply opened up access completely to physical memory for any device. However, Windows would not do this. It would only open up access to devices that it thought needed DMA. This is why Metlstorm had to make his Linux machine behave like an iPod to fool Windows into spreading it's legs. Since the exploit tools came out for this, free OSes quickly started providing options to tell the chips not to open up access. I have tested the Linux drivers with the phys_dma=0 option, and found that some disk devices worked fine while others did not. I can confirm that the memory dumping tools did not work with this option set. Of course this is not an optimal fix. The drivers should just automatically restrict the DMA accesses in real time to a range that is safe but still permits devices to use it. (Presumably to buffers allocated specifically for I/O.) Not sure if some devices would still have problems with this, but I think this is the intended operation of ieee1394 based on the specs and I'd imagine it would work on a greater number of devices than having it disabled completely. Someone please correct me if I'm wrong on any of this. tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
key, then don't have autorun (which is default) automatically enabled for the device. Thanks to Blue Boar for pointing out that autorun doesn't have anything to do with it if the attack device can have the drivers automatically installed (and, of course, that the host controller is enabled). Original points stand... t ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Let's say the computer is off. You can turn it on, but that gets you to a login screen. What can the Firewire device do? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Let's say the computer is off. You can turn it on, but that gets you to a login screen. What can the Firewire device do? OK, I guess I misunderstood the original paper (http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks .pdf). It now looks to me like they are claiming they can disable password authentication *even while the system is not logged on* - do I have that right? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
The main point is to grab encryption keys from memory where the drive is encrypted - but that has to be while the device is on. I mean, it doesn't really matter if you disable password auth when you have physical access as you can just take the drive out, boot from CD, etc... t -Original Message- From: [EMAIL PROTECTED] [mailto:full- [EMAIL PROTECTED] On Behalf Of Larry Seltzer Sent: Friday, March 07, 2008 11:51 AM To: Bugtraq; Full Disclosure Subject: Re: [Full-disclosure] Firewire Attack on Windows Vista Let's say the computer is off. You can turn it on, but that gets you to a login screen. What can the Firewire device do? OK, I guess I misunderstood the original paper (http://www.sec- consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks .pdf). It now looks to me like they are claiming they can disable password authentication *even while the system is not logged on* - do I have that right? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
On Fri, 07 Mar 2008 14:51:07 -0500, Larry Seltzer wrote: Let's say the computer is off. You can turn it on, but that gets you to a login screen. What can the Firewire device do? OK, I guess I misunderstood the original paper (http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks .pdf). It now looks to me like they are claiming they can disable password authentication *even while the system is not logged on* - do I have that right? Larry, Are you familiar with ICE or JTAG debugging hardware? ieee1394 is implemented by default in such a fashion that a ieee1394 port can basically be used as a hardware debugger to memory. i.e. any ieee1394 device can poke/peek the entire _physical memory space_ of any other device on the bus. With that capability you can do anything that could be accomplished from the internals of the operating system. The essential flaw here is that current SBP-2 drivers do not set up a proper virtual memory map between the firewire chipset and the host, and just expose the entire host's physical address space. Fixing this requires reimplementing a good deal of design and buffering for the SBP-2 (that's the firewire SCSI block protocol) drivers. I however, don't know enough about windows drivers and disk access to elaborate from there about how hard that will be to fix in the windows world. What people seem to be missing is that this condition is *fixable*, but the real impetus may not be there outside of folks from the Trusted Computing crowd etc etc. What points are you trying to stab at for an article? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Roger, you should note that Adam's Hit by a Bus paper includes information about how Linux users can load their OS' Firewire driver in a way that should disallow physical memory DMA access, and close this attack vector. What are the implications for firewire device compatibility of doing this? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
...Windows would not do this. It would only open up access to devices that it thought needed DMA. This is why Metlstorm had to make his Linux machine behave like an iPod to fool Windows into spreading it's legs. So the iPod software opens up the whole address space? I don't get it. No, the iPod device signature makes Windows drivers think it should allow DMA access for that device because it detect it as a disk device. Other disk device signatures would likely work the same way, that's just the one he happened to emulate. tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
An anonymous list lurker asked me off-list to answer this question for public gratification: Can this feature be leveraged without drivers on the target system? IOW, if one just unloads (or doesn't load) the firewire driver, is it still exploitable? No, I don't believe so. At least on Linux, the drivers have to explicitly open up access when they are loaded for the attack to work. By the chipset access restrictions are prevent this. Of course YMMV on particular pieces of hardware. There's just one vendor (Texas Instruments) who produces the vast majority of these chipsets though, so I doubt there's a large amount of variation from system to system. tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
No, the iPod device signature makes Windows drivers think it should allow DMA access for that device because it detect it as a disk device. Other disk device signatures would likely work the same way, that's just the one he happened to emulate. Is it not possible for Windows (or any OS) to open up DMA for a device only to a certain range? If not, what options are available? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Is it not possible for Windows (or any OS) to open up DMA for a device only to a certain range? If not, what options are available? I have various forms of RSI and don't feel like typing it again: On Thu, Mar 06, 2008 at 12:00:09PM -0800, Tim wrote: [...] Of course this is not an optimal fix. The drivers should just automatically restrict the DMA accesses in real time to a range that is safe but still permits devices to use it. (Presumably to buffers allocated specifically for I/O.) Not sure if some devices would still have problems with this, but I think this is the intended operation of ieee1394 based on the specs and I'd imagine it would work on a greater number of devices than having it disabled completely. [...] So yes, this is possible. AFAIK, driver writers on all sides have just been lazy. At least with free OSes they have a lame hack to protect you. tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
-Original Message- From: Larry Seltzer [mailto:[EMAIL PROTECTED] Sent: Thursday, March 06, 2008 9:51 AM To: Peter Watkins; Roger A. Grimes Cc: Bernhard Mueller; Full Disclosure; Bugtraq Subject: RE: Firewire Attack on Windows Vista Roger, you should note that Adam's Hit by a Bus paper includes information about how Linux users can load their OS' Firewire driver in a way that should disallow physical memory DMA access, and close this attack vector. What are the implications for firewire device compatibility of doing this? Probably the same as just disabling the 1394 bus host controller in Vista ;) t ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Hi Glenn, It should be realized though that fixing this is not necessarily a simple thing, nor are architectural considerations missing. I most probably understated the difficulty of implementing a safe ieee1394 DMA driver earlier. However, it's one of those things where the drivers ought to at least default to a safe configuration and allow those who like operating in the wild west for the purposes of speed to do so. As for what can be done by Windows (as opposed to any OS), that is perhaps limited by the great range of underlying hardware. A compromise which might allow DMA to/from disks, tapes, or CDs but disallow it for most other peripherals might turn out to be the best general solution available, or something comparably ugly. In the specific case of FireWire, Windows already does this, but that is exactly how the restrictions were bypassed. You can't trust a disk device any more than any other device, since a laptop can simply emulate a storage device. cheers, tim ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Certainly in VMS there is DMA opened up, but only to buffers that are known and checked to be legal for such. This is a source of considerable complexity in the drivers, and depending on hardware architecture (number of control registers available, for example, to control DMA channels) limits both number of concurrent operations and size of some operations. For example, the max size of magtape records is limited, in part to conserve such bandwidth for use with disks. If driver writers adopt a wild-west approach where the DMA space is left wide open, obviously the security of anything within memory is totally open to whatever a smart peripheral may do. It should be realized though that fixing this is not necessarily a simple thing, nor are architectural considerations missing. But with the advent of more and more smart peripherals (at least some of which are commonly user programmable), open DMA access amounts to peek/poke control over all of memory and the abdication by the OS involved of any pretense of security whatever. As for what can be done by Windows (as opposed to any OS), that is perhaps limited by the great range of underlying hardware. A compromise which might allow DMA to/from disks, tapes, or CDs but disallow it for most other peripherals might turn out to be the best general solution available, or something comparably ugly. Glenn Everhart -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Larry Seltzer Sent: Thursday, March 06, 2008 3:36 PM To: Tim Cc: Full Disclosure; Bugtraq Subject: Re: [Full-disclosure] Firewire Attack on Windows Vista No, the iPod device signature makes Windows drivers think it should allow DMA access for that device because it detect it as a disk device. Other disk device signatures would likely work the same way, that's just the one he happened to emulate. Is it not possible for Windows (or any OS) to open up DMA for a device only to a certain range? If not, what options are available? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ - This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. Although this transmission and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by JPMorgan Chase Co., its subsidiaries and affiliates, as applicable, for any loss or damage arising in any way from its use. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Dear All, That said the original work on this from metlstorm is in the news [1] and can be found here : http://storm.net.nz/projects/16 [1] http://it.slashdot.org/article.pl?sid=08/03/04/1258210from=rss -- http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
I believe their work is an expansion of this: http://www.theage.com.au/news/security/hack-into-a-windows-pc-no-password-needed/2008/03/04/1204402423638.html, which demonstrated the vuln. in XP (and, according to the paper, it's been demonstrated with other OS's as well), and their work was specifically done on showing the problem in Vista, which hadn't (as far as the paper writer seems to know) been done before. Maus On Wed, Mar 5, 2008 at 4:30 PM, Roger A. Grimes [EMAIL PROTECTED] wrote: As somewhat indicated in the paper itself, these types of physical DMA attacks are possible against any PC-based OS, not just Windows. If that's true, why is the paper titled around Windows Vista? I guess it makes headlines faster. But isn't as important, if not more important, to say all PC-based systems have the same underlying problem? That it's a broader problem needing a broader solution, instead of picking on one OS vendor to get headlines? [Disclaimer: I'm a full-time Microsoft employee.] Roger * *Roger A. Grimes, InfoWorld, Security Columnist *CPA, CISSP, CISA, MCSE: Security (2000/2003), CEH, yada...yada... *email: [EMAIL PROTECTED] or [EMAIL PROTECTED] *Author of Windows Vista Security: Securing Vista Against Malicious Attacks (Wiley) * http://www.amazon.com/Windows-Vista-Security-Securing-Malicious/dp/0470101555 * -Original Message- From: Bernhard Mueller [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 05, 2008 10:54 AM To: Full Disclosure; Bugtraq Subject: Firewire Attack on Windows Vista Hello, In the light of recent discussions about firewire / DMA hacks, we would like to throw in some of the results of our past research on this topic (done mainly by Peter Panholzer) in the form of a short whitepaper. In this paper, we demonstrate that the firewire unlock attack (as implemented in Adam Boileau´s winlockpwn) can be used against Windows Vista. The paper is available at: http://www.sec-consult.com/fileadmin/Whitepapers/Vista_Physical_Attacks.pdf Best regards, Bernhard -- _ Bernhard Mueller Security Consultant SEC Consult Unternehmensberatung GmbH www.sec-consult.com A-1190 Vienna, Mooslackengasse 17 phone +43 1 8903043 34 fax +43 1 8903043 15 mobile+43 676 840301 718 email [EMAIL PROTECTED] Firmenbuch Wiener Neustadt: 227896t, UID: ATU56165223 Firmensitz: Prof. Dr. Stephan Korenstraße 10, A-2700 Wiener Neustadt Advisor for your information security. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
On Thu, 6 Mar 2008, Roger A. Grimes wrote: As somewhat indicated in the paper itself, these types of physical DMA attacks are possible against any PC-based OS, not just Windows. If that's true, why is the paper titled around Windows Vista? I guess it makes headlines faster. But isn't as important, if not more important, to say all PC-based systems have the same underlying problem? That it's a broader problem needing a broader solution, instead of picking on one OS vendor to get headlines? Well it IS a new kid on the block, other systems have already had this problem reported.. It would certainly be more interesting if Vista wasn't vulnerable though :) That said, according to the fwohci source in FreeBSD you have to explicitly enable this feature and the fwohci man page says it is mandatory for SBP. It would not be too difficult to disable it by default unless and SBP device is in use. Even in that case it is apparently possible to limit the access granted to a particular device (eg only allow it for the places you expect the device to write to). -- Daniel O'Connor software and network engineer for Genesis Software - http://www.gsoft.com.au The nice thing about standards is that there are so many of them to choose from. -- Andrew Tanenbaum GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C signature.asc Description: This is a digitally signed message part. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
On Wed, Mar 05, 2008 at 04:30:35PM -0500, Roger A. Grimes wrote: As somewhat indicated in the paper itself, these types of physical DMA attacks are possible against any PC-based OS, not just Windows. If that's true, why is the paper titled around Windows Vista? I guess it makes headlines faster. But isn't as important, if not more important, to say all PC-based systems have the same underlying problem? That it's a broader problem needing a broader solution, instead of picking on one OS vendor to get headlines? Roger, you should note that Adam's Hit by a Bus paper includes information about how Linux users can load their OS' Firewire driver in a way that should disallow physical memory DMA access, and close this attack vector. I have not yet seen anyone explain how to do the same in Windows. If there is no such option in Windows (as the Panholzer paper claims), then Microsoft deserves the negative attention. [Disclaimer: I'm a full-time Microsoft employee.] As for broader solutions, Microsoft is in an excellent position to help improve the situation -- maybe you could shed some light on their efforts? -Peter ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Firewire Attack on Windows Vista
Salut, Roger, On Wed, 5 Mar 2008 16:30:35 -0500, Roger A. Grimes wrote: As somewhat indicated in the paper itself, these types of physical DMA attacks are possible against any PC-based OS, not just Windows. If that's true, why is the paper titled around Windows Vista? That's very easy: because the specific attack was against Windows Vista's activation mechanism. The deficiencies of Firewire with regard to direct memory access have been known for quite a while now. The purpose of the referenced attack was specific to Windows Vista. It is of course also possible though to steal GnuPG keys from the memory of a Solaris machine, of course, that's in the nature of the beast, but this is not relevant to the specific attack mentioned here. May I also add that I am actually aware of patches from vendors which can render this attack ineffective for most other OSes (Solaris, Linux, etc.) - as far as I know, though, there is no such patch for Windows? That might also be a reason why this attack was created and published in the first place - like I said, the attack vector has been known for ages now. [Disclaimer: I'm a full-time Microsoft employee.] Hi there. ;-) Tonnerre -- SyGroup GmbH Tonnerre Lombard Solutions Systematiques Tel:+41 61 333 80 33Güterstrasse 86 Fax:+41 61 383 14 674053 Basel Web:www.sygroup.ch [EMAIL PROTECTED] signature.asc Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
