TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

New dog, old trick: DaMAgeCard attack targets memory directly via SD card reader

187 点作者 thebeardisred5 个月前

7 条评论

Animats5 个月前
FireWire had a backdoor into memory. FireWire isn&#x27;t a &quot;bus&quot;, it&#x27;s a local area network. Mostly you send packets around. IP over Firewire was a thing. But there are also built-in packets to read and write memory, one word at a time. That&#x27;s how commands are sent. This probably made sense to people who thought in terms of device registers, rather than a command with parameters.<p>There&#x27;s a register in most Firewire controllers where you can set the address bounds for which that function is available. I once noted that the hard-coded default values for Linux were 0 .. 2^32-1, that is, the first 4GB. I reported this as a security bug and was told it was needed for the kernel debugger.<p>Sigh.
评论 #42375761 未加载
评论 #42375208 未加载
formerly_proven5 个月前
While SD Express remains profoundly unpopular, the CFExpress standard (preceded by XQD) is the norm for mid-range and up cameras these days. And CFX is, just like you expected, simply a (well-specified subset of) NVMe SSD in a somewhat more robust case. CFX readers are generally just like the article describes the SDX USB reader: There&#x27;s a chip in there which talks PCIe and NVMe to the SSD and emulates SCSI over USB (UASP) on the host side:<p>&gt; Wait a second. USB3 doesn’t do Bus Mastering. Either there’s something wrong with the device description, or there’s some hardcore multiplexing of lines going on. But the reality was less exсiting — it uses a JMicron JMS581LT host controller chip, which implements PCIe root&#x2F;switch&#x2F;something at least partially, and communicates with the card over PCIe. But it doesn’t pass it to the host, and communicates with the host over 10 Gib&#x2F;s USB. Interesting chip overall, but not interesting as a DMA target.<p>However, there <i>are</i> also Thunderbolt CFX readers. And those do actually hook up the SSD to the host directly.<p>&gt; By the way, the photo camera probably doesn’t need the speed of PCIe<p>&quot;need&quot; is a curious question, if you&#x27;re inclined to shoot RAW + JPG and let &#x27;er rip at 20 frames per second (no shutter means no wear, after all!) you&#x27;re producing around 1.5 gigabytes of photos... per second. (In practice, card write speeds seem to tap out at around 850 MB&#x2F;s).
评论 #42378393 未加载
Syonyk5 个月前
That&#x27;s a solid writeup on the history of external DMA attacks! Very nicely done, and well worth a read.<p>This sort of thing is why QubesOS tends to put hardware controllers in isolated VMs and only pass access through. With a working IOMMU (any modern hardware has this), all you can get is DMA access into a VM that doesn&#x27;t actually have much of interest in it, and no access into other VMs...<p>&#x2F;&#x2F;EDIT: Though at a closer read, there&#x27;s some that... isn&#x27;t quite right, in how terms and examples are done. I&#x27;d expect better from someone doing low level security work - INB copies to a general purpose register, not a memory address, a DMA controller is a &quot;discrete&quot; bit of hardware, it&#x27;s not very &quot;discreet,&quot; etc. I&#x27;m not sure. This is starting to feel very AI-assisted to me. The overall concepts are fine, but a lot of the background section doesn&#x27;t read reasonably, or goes off into weird weeds and... never explores them. The Intel Xeon is not a less exotic example of a DMA controller. The PC&#x2F;AT platform did not have a PCI bus.<p>Eh. I remain convinced it&#x27;s a decent enough overview of the matter, but a lot of the details just read really weird to me in the background sections. To the point that this could be an interview discussion question. &quot;What does this get subtly wrong?&quot;
评论 #42371015 未加载
评论 #42370318 未加载
评论 #42371698 未加载
评论 #42370444 未加载
评论 #42373346 未加载
moreati5 个月前
I&#x27;m pleasantly surprised there are any devices supporting SD Express. I thought the standard had died on the vine. So Apple, please pull your finger out and include SD Express in the MBP models that have an SD slot.
cjbprime5 个月前
It would have been good to hear about whether there are still any mainstream computer platforms that ship with IOMMU off, since it is the mitigation here.
snvzz5 个月前
DMA. The gift that keeps on giving.<p>God bless the blitter.<p>Fat Agnus be fat.
speransky5 个月前
Read like a novel, well done