If we banned the hotplug of new devices when the system is in a locked state, would that be sufficient to mitigate these attacks via system buses with DMA access?
"No password? No hotplug for you." seems like a rule we ought to be enforcing.
"No password? No hotplug for you." seems like a rule we ought to be enforcing.
"Note: Mavericks since 10.8.2 on Ivy Bridge (>= 2012 Macs)
have enabled VT-D effectively blocking DMA requests and thwarting
almost all modules."