Tonnerre Lombard
07/03/08, 13:55
--Sig_DDCHFMcF2BgcDao.ZesIe38
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Salut, Roger,
On Wed, 5 Mar 2008 16:30:35 -0500, Roger A. Grimes wrote:
> As somewhat indicated in the paper itself, these types of physical
> DMA attacks are possible against any PC-based OS, not just Windows.
> If that's true, why is the paper titled around Windows Vista?
That's very easy: because the specific attack was against Windows
Vista's activation mechanism.
The deficiencies of Firewire with regard to direct memory access have
been known for quite a while now. The purpose of the referenced attack
was specific to Windows Vista. It is of course also possible though to
steal GnuPG keys from the memory of a Solaris machine, of course,
that's in the nature of the beast, but this is not relevant to the
specific attack mentioned here.
May I also add that I am actually aware of patches from vendors which
can render this attack ineffective for most other OSes (Solaris, Linux,
etc.) - as far as I know, though, there is no such patch for Windows?
That might also be a reason why this attack was created and published
in the first place - like I said, the attack vector has been known for
ages now.
> [Disclaimer: I'm a full-time Microsoft employee.]=20
Hi there. ;-)
Tonnerre
--=20
SyGroup GmbH
Tonnerre Lombard
Solutions Systematiques
Tel:+41 61 333 80 33 G=C3=BCterstrasse 86
Fax:+41 61 383 14 67 4053 Basel
Web:www.sygroup.ch tonnerre.lombard@sygroup.ch
--Sig_DDCHFMcF2BgcDao.ZesIe38
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (NetBSD)
iQIVAwUBR8+jPfe1GkGzEUDeAQIg7Q/9HtG9hx3Q5ubGuuMXylZYfQgC1KH0eHKM
lDabkBb7ZoamwvKSPOuojoOY16OsNUvHOdxPmfdaSPUmdtQFyw S6hewAQX9FaHZT
oIurMuvSrWvGdNrgI9gpE6xVckNIlf3TnrZEvxpfveThz44C6J xbJ6hj93LhNBKd
2xmrBDrZYcoupRAHBeNO4pdRcUaVaNs054dLVR33B29a7gkwtV 5OnmEVoaK3rjDm
tH3ttCEcXRLo3IMw0EIT8MkGlLyODzA0W25e3eI/47hfV8+MxosEk53wNwfrr7m7
5HtfUAvEsOfi7k41Kg2t6yGZqoAyNK2qJJ9lR3qJ+4527qd+Q5 BD5nO9G7lHO+KB
PAzyDS4UYDFhe9DzG05z2oMfEUnkeAsNyM3A3Cxj2M0g+GK1p9 MzjNiNjKbc/09a
XVyN92kwpMG+vGKlBtCwR/ljr9uIKsLmKl93xiRlZyZo0GTPijnFoNZr71d4+GYY
wu5xrp02xrXAv8pDlWRLq7BPCfGEdNXJZpZH/H8ihoKKxpTG5dsTB0lUu+edzRvR
NwSCkCLZBTRBIi8VeCG3VrE1mov2Z6SER+IBMBB+3OFp+KxcJ/tkIZI6R1NCijIj
XskICajArRMYJrXxMVR/AlZX95cyR4CF/SfeRHeZFoIejAtsQ0Qw9XwHoy99o1N2
r24bwNmgJ1E=
=KRVD
-----END PGP SIGNATURE-----
--Sig_DDCHFMcF2BgcDao.ZesIe38--
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Salut, Roger,
On Wed, 5 Mar 2008 16:30:35 -0500, Roger A. Grimes wrote:
> As somewhat indicated in the paper itself, these types of physical
> DMA attacks are possible against any PC-based OS, not just Windows.
> If that's true, why is the paper titled around Windows Vista?
That's very easy: because the specific attack was against Windows
Vista's activation mechanism.
The deficiencies of Firewire with regard to direct memory access have
been known for quite a while now. The purpose of the referenced attack
was specific to Windows Vista. It is of course also possible though to
steal GnuPG keys from the memory of a Solaris machine, of course,
that's in the nature of the beast, but this is not relevant to the
specific attack mentioned here.
May I also add that I am actually aware of patches from vendors which
can render this attack ineffective for most other OSes (Solaris, Linux,
etc.) - as far as I know, though, there is no such patch for Windows?
That might also be a reason why this attack was created and published
in the first place - like I said, the attack vector has been known for
ages now.
> [Disclaimer: I'm a full-time Microsoft employee.]=20
Hi there. ;-)
Tonnerre
--=20
SyGroup GmbH
Tonnerre Lombard
Solutions Systematiques
Tel:+41 61 333 80 33 G=C3=BCterstrasse 86
Fax:+41 61 383 14 67 4053 Basel
Web:www.sygroup.ch tonnerre.lombard@sygroup.ch
--Sig_DDCHFMcF2BgcDao.ZesIe38
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (NetBSD)
iQIVAwUBR8+jPfe1GkGzEUDeAQIg7Q/9HtG9hx3Q5ubGuuMXylZYfQgC1KH0eHKM
lDabkBb7ZoamwvKSPOuojoOY16OsNUvHOdxPmfdaSPUmdtQFyw S6hewAQX9FaHZT
oIurMuvSrWvGdNrgI9gpE6xVckNIlf3TnrZEvxpfveThz44C6J xbJ6hj93LhNBKd
2xmrBDrZYcoupRAHBeNO4pdRcUaVaNs054dLVR33B29a7gkwtV 5OnmEVoaK3rjDm
tH3ttCEcXRLo3IMw0EIT8MkGlLyODzA0W25e3eI/47hfV8+MxosEk53wNwfrr7m7
5HtfUAvEsOfi7k41Kg2t6yGZqoAyNK2qJJ9lR3qJ+4527qd+Q5 BD5nO9G7lHO+KB
PAzyDS4UYDFhe9DzG05z2oMfEUnkeAsNyM3A3Cxj2M0g+GK1p9 MzjNiNjKbc/09a
XVyN92kwpMG+vGKlBtCwR/ljr9uIKsLmKl93xiRlZyZo0GTPijnFoNZr71d4+GYY
wu5xrp02xrXAv8pDlWRLq7BPCfGEdNXJZpZH/H8ihoKKxpTG5dsTB0lUu+edzRvR
NwSCkCLZBTRBIi8VeCG3VrE1mov2Z6SER+IBMBB+3OFp+KxcJ/tkIZI6R1NCijIj
XskICajArRMYJrXxMVR/AlZX95cyR4CF/SfeRHeZFoIejAtsQ0Qw9XwHoy99o1N2
r24bwNmgJ1E=
=KRVD
-----END PGP SIGNATURE-----
--Sig_DDCHFMcF2BgcDao.ZesIe38--