Re: Firewire Attack on Windows Vista

[Pavel Kankovsky <peak () argo troja mff cuni cz>]

On Fri, 7 Mar 2008, Erik Trulsson wrote:

> I wonder what other expansion ports can allow such control over the host
> computer. What about SCSI (which Firewire is partly based on in some
> aspects)? Or eSATA?  Or PCMCIA/PCCard?

Good question.

SCSI: I do not think you can coax the HBA to let you access arbitrary 
parts of the host memory. You can probably do nasty things to other SCSI 
devices when you are attached to a shared bus.

eSATA: Probably quite safe, everything you have got is a point-to-point
connection to the HBA. I suppose the HBA will not allow you to mess with 
the host or with other devices.

PCMCIA/PCCard: Afaik you get a direct connection to the host bus: ISA for
PCMCIA/PCCard, PCI for CardBus and PCIe (or USB) for ExpressCard. If you
get a bus-mastering device inserted into such a slot, you can probably 
access the host memory (within the DMA address range) without much 
trouble.

> USB is probably safe.

B in USB stands for a bus. You could probably do some interesting tricks
when you find yourself attached to the same bus as a trusted device (like 
a keyboard).

-- 
Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
"For death is come up into our MS Windows(tm)..." \ 21th century edition /

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/