No smoke without Firewire

In a recent programme on ITRadio.com.au, host Patrick Gray interviewed Kiwi security researcher Adam Boileau about his software called Winlockpwn. This software allows you to unlock Windows computers using what Gray describes succinctly as “Firewire trickery”. Boileau was pretty careful in the interview to explain that this is can be considered an expected side-effect of having a live Firewire port on an unattended computer, Windows or not. Nevertheless, the story has grown in some quarters to suggest that this is an unpatched, unsolved vulnerability which needs immediate and special attention.

So let’s revisit the story quickly.

Q. A guy in New Zealand can break into my Windows computer!

A. Not quite. A guy in New Zealand has published some code which, amongst other things, shows how to use a Firewire link on a live Windows system to turn off password checking at the screen which says This computer is in use and has been locked. He does this by using the Firewire connection to alter memory on the target computer. He can’t break into your computer remotely from New Zealand — he needs physical access to your PC whilst it is turned on.

Q. This is terrible! When will Microsoft produce a patch?

A. This isn’t really a vulnerability or a bug. For better or for worse, it’s a feature of the Firewire interface. Firewire supports what is called DMA (Direct Memory Access). This allows the Firewire hardware controller on your motherboard to read and write system memory directly, for flexibility and performance. It makes the Firewire interface great for high-bandwidth data capture, such as digital video, and it is also handy for remote system debugging and system forensics.

Q. What? You’re suggesting this DMA business is a good thing?

A. When programmers talk about “breaking into” a running process, they are not proposing a crime. Relying on the operating system and the main processor is unreliable when you are debugging  system software, especially if the system software itself has gone haywire. In this context, breaking in means regaining control.

Likewise, letting a hardware device such as a video camera upload data directly into PC memory, without waiting for assistance from the operating system, means that you don’t need to worry about lost frames or patchy sound.

Q. Are you saying that Microsoft can’t do anything about this?

A. Microsoft has had a solution for years: if you have a Firewire port, disable the Firewire driver when you aren’t using it. That way, if someone does plug into your port unexpectedly, they can’t use it to interact with your PC, legimitately or otherwise.

And look after your PC when it’s unattended. A software lock on the keyboard and mouse provides some additional safety against fiddling, but it’s not a proper security solution.

Q. What? I have to turn off my PC and secure it when I’m not using it? I can’t leave it lying around ready for later?

A. Why would you give physical access to your PC to people you don’t trust?

I know people who’d think three times about asking a passing stranger to take their photo in front of the Sydney Opera House in case the stranger did a runner with the camera, but who are much more casual with their laptop PC, as long as it’s software-locked. Yet their computer hardware alone is worth five times as much as the camera, and the data on the PC is worth at least ten times as much again.

If you aren’t using Firewire — and on a business PC there is often no need for it unless you are in the process of importing video — then don’t enable the Firewire driver, and you won’t be providing a port through which an outsider can get access to system memory.

Don’t turn on system features you don’t need.