The
SANS ISC posted an article titled "Pontsec Disk Encryption Cracked". Really?
Cracked? I was thinking that there was some new cool uber l337 hax0r tool that breaks disk encryption from boot...and no, this isn't the
cold boot attack that has gotten all the attention lately. This is the firewire attack (winlockpwn tool) on Windows that has been known since
security researcher Adam Boileau discovered this "feature" back in 2006 (it's just that the code hasn't been released until recently). Adam sums up the firewire "feature" best on his
web site:
"Yes, you can read and write main memory over firewire on windows.
Yes, this means you can completely own any box who's firewire port you can plug into in seconds.
Yes, it requires physical access. People with physical access win in lots of ways. Sure, this is fast and easy, but it's just one of many.
Yes, it's a FEATURE, not a bug. It's the Fire in Firewire. Yes, I know this, Microsoft know this. The OHCI-1394 spec knows this. People with firewire ports generally dont."
This LuciData "hack" doesn't crack disk encryption at all. If the laptop was powered off..that's a different story. Like Adam says...if you have physical access to a live computer there are lots of attacks you could do..not just the firewire one. Before we
announce that the sky is falling...lets get the real details first please. If you are using any disk encryption (not just Pointsec) you should be using pre-boot authentication anyway as this is what most vendors recommend as a best practice for a corporate deployment.
«
Prev item - Next Item »
---------------------------------------------
Comments
Another nice feature of windows is autorun. When a disk is inserted containing an autorun, windows will (by default, you can turn it off) execute it.
Check out this video:
http://www.irongeek.com/i.p...
When submitting a comment you may not see it until it is approved by the moderator!