FireWire Security issues

[Brooks Davis]

On Wed, Nov 17, 2004 at 04:28:02PM +0100, Borja Marcos wrote:
> >yes we've been aware of this problem for a year or so :-)
> >I guess we need to get the filters done..
> >We do of course use firewire for remote kernel debugging with great 
> >success so we
> >need to be able to turn it off sometimes :-)
> 
> 	Anyway, Firewire isn't Ethernet. A rogue device connected to an SCSI 
> port (or an USB port)  could sniff traffic sent to other devices, isn't 
> it? It's a matter of how closely-coupled do you consider the interface; 
> an Ethernet is more loosely coupled than a Firewire. You assume than an 
> Ethernet may carry dangerous traffic, but, do you assume the same for a 
> SCSI, a USB or a Firewire port, I mean, the kind of interface you use 
> for hard disks, etc?
> 
> 	BTW, provided that USB ports are connected in parallel... a rogue 
> 	USB device could sniff a user's keyboard activity or even generate rogue 
> keyboard activity, isn't it?

Firewire presents much more risk then most other busses because it
provides direct access to the address space of the host machine.  The
means you can read or modify everything include kernel code and data.
That said, this is really useful for debugging.

-- Brooks

-- 
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-security/attachments/20041117/e7249f33/attachment.bin