Attack via FireWire Port
There are some issues in IT that, once checked, can be forgotten with peace of mind. However, failing to do so can lead to significant regret at some point. The FireWire port is precisely that case.
I hope you have enabled system-level encryption; I discussed the consequences of not having such encryption here. Let’s take a very simplified look at how full disk encryption works on your device.
You have an encryption key that encrypts and decrypts all information. When the computer is running, even if the system is locked or in hybrid sleep mode, this key resides in the device's RAM.
By connecting to the FireWire port, this key can be extracted directly from the RAM. This can be done by your conversation partner when you temporarily step away to the restroom in a café, or by a forensic expert during a visit from uninvited guests. Whoever it may be, they will extract information from your RAM, and that is very bad. The attack won't take much time, and the consequences will be quite dire.
In addition, connecting via the FireWire port allows bypassing the system password. This is possible due to overwriting the memory area that contains access control data.
This attack has several nuances; for example, antivirus software may protect against direct access to RAM, and the protocol itself only allows access to the first 4 GB of memory. But despite these nuances, the FireWire port represents a means of direct access to valuable data. At one time, having such a port was considered a real boon for forensic experts.
DMA attacks (Direct Memory Access) are a very dangerous class of physical attacks. We will discuss them extensively, check for vulnerabilities, and configure defenses. In this chapter, our task is to check if your computer has a FireWire port, and if it does, it might be time to work with some wire cutters or change the device.
What is a FireWire Port
The correct name is IEEE 1394 (FireWire, i.LINK, mLAN – commercial names); it is a technology for digital information exchange. The FireWire technology was developed by Apple between 1992 and 1995, and in 1998, FireWire began to gain popularity. After 2010, its popularity sharply declined, and today FireWire is rarely found in new computers. According to Wikipedia, the main reason for the decline is Apple’s desire to receive royalties for each installed bus.