News for hackers. Stuff that matters.

A comment on Microsoft helped the NSA bypass encryption, new Snowden leak reveals. Parent comment

Re:Microsoft helped the NSA bypass encryption, new Snowden l... by dmix on Friday July 12, 2013 @10:19AM (#6032689)
> 3) If attacker has physical access to machine, and machine is powered on (direct memory access via Thunderbolt or Firewire)

I'm curious if this could be addressed with software protections somehow? Something that triggers memory wipes and automatic shutdowns?

[ Parent | on HN ]
Re:Microsoft helped the NSA bypass encryption, new Snowden l... by sil3ntmac on Friday July 12, 2013 @10:50AM (#6032881)
FileVault 2 is supposed to be secure against this* when the machine is powered on and locked or sleeping.

* Source http://security.stackexchange.com/questions/18720/how-secure...

[ Parent | on HN ]
Re:Microsoft helped the NSA bypass encryption, new Snowden l... by dmix on Friday July 12, 2013 @11:24AM (#6033062)
Interesting. Apparently LUKS/dmcrypt on Linux is also protected from DMA attacks (firewire/thunderbolt devices).

> If you enable LUKS root, DMA attack mitigation is also enabled(boot.initrd.luks.mitigateDMAAttacks ). It consists of blacklisting firewire drivers.

Edit: still at risk of the "Evil Maid Attack" http://www.aspecrypt.com/evil_maid_attack.html

[ Parent | on HN ]
Re:Microsoft helped the NSA bypass encryption, new Snowden l... by anologwintermut on Friday July 12, 2013 @10:36AM (#6032796)
http://www.intel.com/content/www/us/en/architecture-and-tech...

Though that specifically obviously requires hardware.

[ Parent | on HN ]
Re:Microsoft helped the NSA bypass encryption, new Snowden l... by dmix on Friday July 12, 2013 @10:48AM (#6032868)
It seems that only protects against "pre-launch software" and BIOS level stuff. The scenario in question is for a live system where the disk is mounted and decrypted, with the OS running.
[ Parent | on HN ]