On Fri, 7 Mar 2008, Erik Trulsson wrote: > I wonder what other expansion ports can allow such control over the host > computer. What about SCSI (which Firewire is partly based on in some > aspects)? Or eSATA? Or PCMCIA/PCCard?
Good question. SCSI: I do not think you can coax the HBA to let you access arbitrary parts of the host memory. You can probably do nasty things to other SCSI devices when you are attached to a shared bus. eSATA: Probably quite safe, everything you have got is a point-to-point connection to the HBA. I suppose the HBA will not allow you to mess with the host or with other devices. PCMCIA/PCCard: Afaik you get a direct connection to the host bus: ISA for PCMCIA/PCCard, PCI for CardBus and PCIe (or USB) for ExpressCard. If you get a bus-mastering device inserted into such a slot, you can probably access the host memory (within the DMA address range) without much trouble. > USB is probably safe. B in USB stands for a bus. You could probably do some interesting tricks when you find yourself attached to the same bus as a trusted device (like a keyboard). -- Pavel Kankovsky aka Peak / Jeremiah 9:21 \ "For death is come up into our MS Windows(tm)..." \ 21th century edition / _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
