Mac OS X Lion Login Passwords Extracted With Ease

Re:Mac OS X Lion Login Passwords Extracted With Ease by masnick on Tuesday July 26, 2011 @09:10AM (#2807097)

Is there any way to get around this? If so, is it implemented in any OS?

I'm no encryption expert, but it seems like you would need to store decryption keys (or in this case, the login password) in plaintext so they could be used by the OS.

An explanation from an expert would be appreciated.

[ Parent | on HN ]

Re:Mac OS X Lion Login Passwords Extracted With Ease by zdw on Tuesday July 26, 2011 @10:39AM (#2807514)

Turning on the firmware password (Either EFI or Open Firmware on PPC machines) disables firewire DMA.

This is a well known and common lockdown procedure for security focused Mac admins, especially as it also prevents booting off of alternate media.

[ Parent | on HN ]

Re:Mac OS X Lion Login Passwords Extracted With Ease by ConstantineXVI on Tuesday July 26, 2011 @09:24AM (#2807159)

Given that FireWire gives you direct, unsecured access to memory, the most secure solution would be to fill your FireWire port (as well as any other interface that has direct memory access, such as ExpressCard or Thunderbolt) with glue or otherwise render it unusable.

[ Parent | on HN ]

Re:Mac OS X Lion Login Passwords Extracted With Ease by masklinn on Tuesday July 26, 2011 @10:24AM (#2807427)

> Given that FireWire gives you direct, unsecured access to memory

FireWire asks for it, but in recent years CPUs have started implementing IOMMUs, which should be useable to "lie" to devices and sandbox DMA'd memory, preventing full memory access to even low level busses (such as FireWire or Thunderbolt)

[ Parent | on HN ]

Re:Mac OS X Lion Login Passwords Extracted With Ease by sciurus on Tuesday July 26, 2011 @10:29AM (#2807453)

On linux you can remove the firewire driver temporarily with 'rmmod firewire_ohci' or permanently by adding 'blacklist firewire_ohci' to /etc/modprobe.d/blacklist.conf.

[ Parent | on HN ]