On 5/9/14 1:08 PM, Steve Weis wrote:
Hi Tom. Does hibernation on a Mac protect from physical memory
extraction by default or is this something yontma configures?
There may be an ACPI/UEFI attack here... UEFI Runtime Service drivers
continue to run in the background while the main OS is running. A UEFI
driver can detect these ACLU Sx states. UEFI includes a full IPv4/IPv6
network stack (optionally bootable via PXE), UEFI apps/drivers can talk
over the net as well as to local storage media.
So, a UEFI runtime service driver could detect hibernation, start
getting active in background over net. IF adversary is smart enough to
figure out how to install an EFI driver onto your system. And you don't
detect the change. So, your EFI malware runtime service might be able to
work while you and the OS think the system is merely hibernating.
EFI's "Fast Boot" feature is the opposite of ACPI hiberation. The B<n>
states of EFI booting are conceptually similar to the S<n> states of
ACPI sleeping. Without "Fast Boot", EFI still controls ACPI hibernation,
just not as quickly (there are redundant re-init/re-scans that are not
"Fast").
ACPI is controlled by the firmware.
OS suspend/resume is controlled by the firmware.
IMO, power box off completely, to be sure there's no weirdness happening
at firmware and silicon levels. Like people remove their batteries from
their smartphones.
PS: EFI-free Novena reached their crowdsourcing goals! You have 9 days
to act before prices increase:
http://www.bunniestudios.com/blog/?p=3750
http://www.crowdsupply.com/kosagi/novena-open-laptop
"at the conclusion of the Crowd Supply campaign on May 18, all the
prices listed below will go up by 10%"
--
Liberationtech is public & archives are searchable on Google. Violations of
list guidelines will get you moderated:
https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change
to digest, or change password by emailing moderator at [email protected].
