-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Interesting thread, I'll come at it from a different perspective.
Computer forensics and incident response also has an application for gaining access to physical memory. Discovering encryption keys from memory and other volatile artifacts may be of use. In respect of incident response how can you trust the OS environment on a compromised machine? Are your traditional IR tools going to lie to you during live analysis and data gathering process? Grabbing memory via firewire minimizes this risk and also ensures least impact on the evidence. OK Joanna Rutkowska has suggested a method to mitigate against these attacks on AMD64 boxes http://invisiblethings.org/papers/cheating-hardware-memory-acquisition-updated.ppt > you're better off in that situation. However, if the attacker > anticipates this, he could simply power the system on, get the > come-out-of-hibernation login prompt, compromise the kernel by injecting > a driver or some such thing with a FireWire Memory attack, and then send > it back into hibernate or something along those lines and wait for the > real user to log in. As you have rightly pointed out grabbing memory isn't the only nefarious activity, if I can login to a target machine then I can deploy all sorts of nasties. Could I use firewire to inject a process similar to a dll injection attack? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFH0/c4bSv1saVS9ucRAorAAKCccsdD3FLzr+GFxe20nBRxgG5QXACbBzFq 1lwZKauGf3O3jXwtREUbmdE= =0yLw -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
