Inception – Break and Enter Using Direct Memory Access

Re:Inception – Break and Enter Using Direct Memory Access by pja on Monday February 23, 2015 @06:44AM (#9093772)

If we banned the hotplug of new devices when the system is in a locked state, would that be sufficient to mitigate these attacks via system buses with DMA access?

"No password? No hotplug for you." seems like a rule we ought to be enforcing.

[ Parent | on HN ]

Re:Inception – Break and Enter Using Direct Memory Access by MrBuddyCasino on Monday February 23, 2015 @07:37AM (#9093933)

  "Note: Mavericks since 10.8.2 on Ivy Bridge (>= 2012 Macs) 
  have enabled VT-D effectively blocking DMA requests and thwarting 
  almost all modules."

Looks like newer models have fixed it, but your suggestion would probably be nice for older systems.

[ Parent | on HN ]

Re:Inception – Break and Enter Using Direct Memory Access by epochwolf on Monday February 23, 2015 @10:05AM (#9094620)

Per the article: If you have a OF/EFI firmware password set on the target Mac OS X, FireWire DMA is off by default.

[ Parent | on HN ]