3) If attacker has physical access to machine, and
       machine is powered on (direct memory access via
       Thunderbolt or Firewire)

http://www.frameloss.org/wp-content/uploads/2011/09/Lion-Mem...

Though apparently there was a company offering a commercial solution for getting FileVault passwords using this method so...

http://privacycast.com/filevault-vulnerability-how-to-protec...

There's also a really interesting pdf from Apple containing more details on FileVault 2:

http://training.apple.com/pdf/WP_FileVault2.pdf

which suggests turning on firmware passwords to prevent DMA.

He specifically mentions he could access the FileVault key of a machine by having physical access, and discovered two secret keys (KPPW and KPST) one of which is enabled when the input buffer is "SpecialisRevelio" [2].

It's a very interesting deck to read through.

[1] http://www.nosuchcon.org/talks/D1_02_Alex_Ninjas_and_Harry_P... [2] http://harrypotter.wikia.com/wiki/Specialis_Revelio

FileVault could be some hypothetical magic uncrackable encryption with a keyspace bigger than the known universe...and it would never matter if there was a backdoor in the OS.

I'm curious if this could be addressed with software protections somehow? Something that triggers memory wipes and automatic shutdowns?

* Source http://security.stackexchange.com/questions/18720/how-secure...

> If you enable LUKS root, DMA attack mitigation is also enabled(boot.initrd.luks.mitigateDMAAttacks ). It consists of blacklisting firewire drivers.

Edit: still at risk of the "Evil Maid Attack" http://www.aspecrypt.com/evil_maid_attack.html

Though that specifically obviously requires hardware.