A security researcher behind Inception, a tool that uses DMA over FireWire and Thunderbolt to access a running machine's memory.
HN links it as proof that DMA attacks over FireWire and Thunderbolt are practical, with commenters noting that Macs mitigate this when the screen is locked.
> I'm not sure why Apple should be singled out for addressing this.
You're correct in that it's not an Apple-only security issue. I'm not sure if the person you're replying to meant to imply that. However, Apple has never been particularly concerned with pointing out security vulnerabilities. Up until three years ago they were claiming that OSX didn't get viruses and that you could be safe by doing nothing. (http://www.theatlantic.com/technology/archive/2012/06/its-official-apple-computers-are-no-longer-virus-free/258902/) That's why Apple gets a lot of flak from security-oriented folk. They mislead tons of people into thinking that "Macs don't get viruses". And I still hear self-proclaimed geniuses who tell me this, and why it's the reason they'll only use Apple products.
Considering Apple changed their slogan to "built to be safe" after being heavily compromised and criticized by the media, they do deserve a push to take care of hardware security issues by default. After all, security is built in, right? Shouldn't they make some proactive security efforts after advertising to their users repeatedly with the premise that their users shouldn't care about security?
> Actually, Apple has shown foresight in its hardware selection
That link you share came around four years after OSX (and Windows) had the login screen compromised with Firewire hacking devices (http://www.hermann-uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation). Of which…
Extremely impressive this, the tenacity of the author is incredible.
Basically the upshot of this article is (for me) that if you own some piece of hardware you can only really trust it if it has never been out of your sight after you bought it (and hopefully it wasn't compromised before you bought it).
Shipping your laptop as checked in luggage, leave it on your desk overnight or go to lunch and when you see it the next time around it might not be your computer any longer.
Another very impressive bit to me was the fact that a financial institution took its security serious enough that they commissioned this work.
The whole thing is reminiscent of the inception hack:
http://www.breaknenter.org/projects/inception/
I'm imagining this guy working for the Apple center on Wall Street or near it plugging a little dongle into every macbook before it gets sold.
Not false I'm afraid. I use this issue to grab FileVault passwords from OSX boxes on a monthly basis.
In combination with DMA access from the Firewire port it can be quite fun[1]. Although with Lion, you can't use DMA when the machine is locked.
"Secure Virtual Memory" only does just that -- Encrypts the memory that is being swapped out to your disk. I've never done a memory dump and found the FileVault password has been swapped out. Probably because it is being used all the time to secure disk read/writes.
The latest OSX really is behind the latest Windows on the security front. Windows has just been the focus of intense hammering on that front over many many years and they've been force to improve their game.
And I say this as a mac user, as 99% of my pentester colleagues are.
[1]: http://www.breaknenter.org/projects/inception/
So it relies on taking a memory dump, this doesn't sound like anything new, for example you can do similar things with https://citp.princeton.edu/research/memory/code/ which is open source.
And you can perform the firewire attack using http://www.breaknenter.org/projects/inception/
Additionally memory can also be dumped via PCI
e.g. http://www.grandideastudio.com/portfolio/tribble/
If you're concerned about such attacks you could use an external device which lets you enter a password using its own keyboard, meaning the key is stored in volatile memory on the external device - not accessible via a memory dumping tool. And then don't leave the device plugged into the computer when you're not around.
And bruteforce attacks have been around for a while using GPUs for instance Passware's forensic program.
So if I understand correctly this can be used to install a persistent hardware rootkit on the chipset that listens for a "secret" knock procedure with TCP (because it has access to the NIC) and then in response to the secret signal modify the host OS kernel through DMA-access to disable for example all access checks [1].
Imagine infecting a machine with this either before delivery (requires physical access, but should be doable for FBI/NSA/foreign-counterpart) or in a "rent a server" situation. Most providers will allow you to rent a full server with root-access for a month and then cancel the contract. I'm assuming those servers get re-used if they're not too old.
[1] Code to disable access checks through DMA has been around for a long time: http://www.breaknenter.org/projects/inception/
Yes, very easy. In a mac you just plug in a Firewire/thunderbolt device[1]. More extreme measures involve freezing the RAM. Both require physical access to the machine, but a bit more scary that plugging your laptop into a public display/TV gives an attacker control of your computer and passwords.
Full disk encryption TrueCrypt/BitLocker/FileVault can act as countermeasures[2] and modern versions of OSX don't allow DMA from the login screen anymore.
[1] http://www.breaknenter.org/2012/02/adventures-with-daisy-in-thunderbolt-dma-land-hacking-macs-through-the-thunderbolt-interface/
[2] http://www.researchgate.net/publication/49277520_Cold_Boot_Memory_Acquisition_An_Investigation_Into_Memory_Freezing_and_Data_Retention_Claims/file/79e415119b9e5376e1.pdf