Hacker News Reader

Comment by bjustin | Hacker News Reader

As the site says, OS X is mostly safe by default. DMA is disabled when a machine is locked or the user is not logged in[1], in OS X 10.7.2+.

[1] https://support.apple.com/kb/HT5002

(missed the note about this on the page the first time through, but I'm leaving this for others who may have missed it)

View on HN

I'm curious, would this be possible in Linux? What would the kernel <-> {xscreensaver,gdm,lightdm,gnome-screensaver,etc} communication work like? How would the pathway be secure from an attacker just turning DMA back on?

How does this work in OSX if a Firewire device is in the middle of a DMA operation when the OS is locked? Does the operation fail? Does the user lose data?

I just removed the module from loading. I dont have any firewire stuff anyways, so it's just some useless 4 pin port at the bottom left of my thinkpad.

No driver, no workey.

Right, but that's not what OSX is apparently doing. It's just limiting DMA operations under specific conditions. I'm wondering what that functionality would look like if implemented in Linux.

I've disabled it in BIOS (didn't find the option on my thinkpad though). It was a bit frustrating though when I, years later, tried to use a firewire media source and had forgotten that I had disabled it :\

The correct way to implement it would be to prevent the initiation of DMA operations when the device is locked, but to let current ones continue. I have no idea if that's what happened, though.

I'm unsure how the DMA operations are structured though. A single 'operation' from the user's perspective might involve multiple operations at a lower level where locking in the middle might allow a single low-level atomic (in-progress) operation to complete, but the overall job to fail.

> DMA is disabled when a machine is locked

For Firewire. What about for Thunderbolt?

Does thunderbolt always use DMA? Perhaps if it's just being used as a screen output then it can turn DMA off but still work.

This was asked on Reddit, and the answer was yes ...

http://www.reddit.com/r/netsec/comments/15ydem/inception_is_...

Another post[1] on the same website suggests that DMA is also disabled for Thunderbolt when the machine is locked.

[1]: http://www.breaknenter.org/2012/02/adventures-with-daisy-in-...

It's still slightly problematic for me. To prevent the re-activation of DMA, I have to disable the Guest account. Unfortunately, this also disables the "Find My iPhone" application. I would like to have both. Is there a way to have the Guest account, but not let people log into it when the machine is locked?

EDIT: Got it. It reactivates the Guest user when you turn on the "Find My" feature, but you can deactivate Guest user afterwards.

Note that this isn't necessary. If you have full disk encryption enabled, the machine will reboot (to a limited OS) when the Guest account is requested.

Reply on news.ycombinator.com