Hacker News Reader

> 3) If attacker has physical access to machine, and machine is powered on (direct memory access via Thunderbolt or Firewire)

I'm curious if this could be addressed with software protections somehow? Something that triggers memory wipes and automatic shutdowns?

View on HN

FileVault 2 is supposed to be secure against this* when the machine is powered on and locked or sleeping.

* Source http://security.stackexchange.com/questions/18720/how-secure...

Interesting. Apparently LUKS/dmcrypt on Linux is also protected from DMA attacks (firewire/thunderbolt devices).

> If you enable LUKS root, DMA attack mitigation is also enabled(boot.initrd.luks.mitigateDMAAttacks ). It consists of blacklisting firewire drivers.

Edit: still at risk of the "Evil Maid Attack" http://www.aspecrypt.com/evil_maid_attack.html

http://www.intel.com/content/www/us/en/architecture-and-tech...

Though that specifically obviously requires hardware.

It seems that only protects against "pre-launch software" and BIOS level stuff. The scenario in question is for a live system where the disk is mounted and decrypted, with the OS running.

Reply on news.ycombinator.com