Break & Enter

You do realize that this is a very easy to pull off attack? http://www.breaknenter.org/projects/inception/ Do you also think people who use screenlocks are tinfoil hatters?

Extremely impressive this, the tenacity of the author is incredible. Basically the upshot of this article is (for me) that if you own some piece of hardware you can only really trust it if it has never been out of your sight after you bought it (and hopefully it wasn't compromised before you bought it). Shipping your laptop as checked in luggage, leave it on your desk overnight or go to lunch and when you see it the next time around it might not be your computer any longer. Another very impressive bit to me was the fact that a financial institution took its security serious enough that they commissioned this work. The whole thing is reminiscent of the inception hack: http://www.breaknenter.org/projects/inception/ I'm imagining this guy working for the Apple center on Wall Street or near it plugging a little dongle into every macbook before it gets sold.

If enabled, you use a firewire connection. You don't even need to reboot and can connect as root to any running processes and filesystems. http://www.breaknenter.org/projects/inception/ Yes, that is actual working technology.

So if I understand correctly this can be used to install a persistent hardware rootkit on the chipset that listens for a "secret" knock procedure with TCP (because it has access to the NIC) and then in response to the secret signal modify the host OS kernel through DMA-access to disable for example all access checks [1]. Imagine infecting a machine with this either before delivery (requires physical access, but should be doable for FBI/NSA/foreign-counterpart) or in a "rent a server" situation. Most providers will allow you to rent a full server with root-access for a month and then cancel the contract. I'm assuming those servers get re-used if they're not too old. [1] Code to disable access checks through DMA has been around for a long time: http://www.breaknenter.org/projects/inception/

It seems thunderbolt in fact DOES provide raw DMA: http://www.breaknenter.org/projects/inception/ But at least on Macs, the attack is somewhat mitigated by the OS shutting off thunderbolt/firewire DMA if the screen is locked.

Yes, very easy. In a mac you just plug in a Firewire/thunderbolt device[1]. More extreme measures involve freezing the RAM. Both require physical access to the machine, but a bit more scary that plugging your laptop into a public display/TV gives an attacker control of your computer and passwords. Full disk encryption TrueCrypt/BitLocker/FileVault can act as countermeasures[2] and modern versions of OSX don't allow DMA from the login screen anymore. [1] http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbol… [2] http://www.researchgate.net/publication/49277520_Cold_Boot_Memory_Acqu…

Here's a good article on vulnerabilities in Thunderbolt: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbol… Turns out OS X 10.7 and later at least disable DMA access while the computer is locked (unless fast user switching is turned on).

Hence http://www.breaknenter.org/projects/inception/ and similar attacks.

At the company I worked for previously we frequently used a firewire DMA attack such as inception (http://www.breaknenter.org/projects/inception/) to gain access to computers, and dump ram to recover other passwords.

Another post[1] on the same website suggests that DMA is also disabled for Thunderbolt when the machine is locked. [1]: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbol…

So it relies on taking a memory dump, this doesn't sound like anything new, for example you can do similar things with https://citp.princeton.edu/research/memory/code/ which is open source. And you can perform the firewire attack using http://www.breaknenter.org/projects/inception/ Additionally memory can also be dumped via PCI e.g. http://www.grandideastudio.com/portfolio/tribble/ If you're concerned about such attacks you could use an external device which lets you enter a password using its own keyboard, meaning the key is stored in volatile memory on the external device - not accessible via a memory dumping tool. And then don't leave the device plugged into the computer when you're not around. And bruteforce attacks have been around for a while using GPUs for instance Passware's forensic program.

There is the ability to protect memory from malicious devices with IOMMU, but it is often disabled by default. My experience with DMA attacks via Firewire or Thunderbolt is that they work out of the box. Inception is a nice tool to play with if you want to try out DMA attacks: http://www.breaknenter.org/projects/inception/ You may also want to check out the Volatility forensics framework: http://code.google.com/p/volatility/

Thunderbolt supports DMA pretty much unrestricted iirc so it's a stupid standard. http://en.wikipedia.org/wiki/DMA_attack http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbol…

Not false I'm afraid. I use this issue to grab FileVault passwords from OSX boxes on a monthly basis. In combination with DMA access from the Firewire port it can be quite fun[1]. Although with Lion, you can't use DMA when the machine is locked. "Secure Virtual Memory" only does just that -- Encrypts the memory that is being swapped out to your disk. I've never done a memory dump and found the FileVault password has been swapped out. Probably because it is being used all the time to secure disk read/writes. The latest OSX really is behind the latest Windows on the security front. Windows has just been the focus of intense hammering on that front over many many years and they've been force to improve their game. And I say this as a mac user, as 99% of my pentester colleagues are. [1]: http://www.breaknenter.org/projects/inception/

> I'm not sure why Apple should be singled out for addressing this. You're correct in that it's not an Apple-only security issue. I'm not sure if the person you're replying to meant to imply that. However, Apple has never been particularly concerned with pointing out security vulnerabilities. Up until three years ago they were claiming that OSX didn't get viruses and that you could be safe by doing nothing. (http://www.theatlantic.com/technology/archive/2012/06/its-official-app… That's why Apple gets a lot of flak from security-oriented folk. They mislead tons of people into thinking that "Macs don't get viruses". And I still hear self-proclaimed geniuses who tell me this, and why it's the reason they'll only use Apple products. Considering Apple changed their slogan to "built to be safe" after being heavily compromised and criticized by the media, they do deserve a push to take care of hardware security issues by default. After all, security is built in, right? Shouldn't they make some proactive security efforts after advertising to their users repeatedly with the premise that their users shouldn't care about security? > Actually, Apple has shown foresight in its hardware selection That link you share came around four years after OSX (and Windows) had the login screen compromised with Firewire hacking devices (http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dm… Of which…