Re: Firewire Attack on Windows Vista

[Tim <tim-security () sentinelchicken org>]

> Yeah, I made specific reference to that attack in my message. There's a
> big difference between sleep mode and hibernate mode. In hibernate the
> system is powered off. Even if the memory has some residual charge I'm
> sure it's far less reliable than with sleep. 

Yeah, but the whole point is if it's written to disk, the data is much
easier to get at.  The hard thing to do is steal memory.  I've read that
some HD encryption systems encrypt the hibernate file too, so perhaps
you're better off in that situation.  However, if the attacker
anticipates this, he could simply power the system on, get the
come-out-of-hibernation login prompt, compromise the kernel by injecting
a driver or some such thing with a FireWire Memory attack, and then send
it back into hibernate or something along those lines and wait for the
real user to log in.

I can't say that I keep up on the particulars of how Windows does this
or that or the other related to hibernation and encryption, so perhaps
the specific attack above is flawed, but if you get to physical memory
and it's game over.  Doesn't matter what you do with obfuscation around
encryption.

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/