[enneff]

I thought this was a hardware-based attack. Does it matter whether the OS supports firewire or not?

[rinkhals]

http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f...

"We have successfully tested that after unloading AppleFWOHCI.kext the current tools won't work anymore."

If that's true then an option for those who need to use FW/TB devices is to remove the drivers from the system folder to prevent loading at startup and kextload/kextunload on demand.

The following named drivers are present in "/System/Library/Extensions/" :

IOFireWireAVC.kext IOFireWireFamily.kext //(The AppleFWOHCI.kext mentioned above is included here) IOFireWireIP.kext IOFireWireSBP2.kext IOFireWireSerialBusProtocolTransport.kext

IOThunderboltFamily.kext AppleThunderboltDPAdapters.kext AppleThunderboltEDMService.kext AppleThunderboltNHI.kext AppleThunderboltPCIAdapters.kext AppleThunderboltUTDM.kext

[jensnockert]

Without the driver, Firewire DMA is not enabled, so yes, it does matter. It is mentioned in the article.

Lion even disables Firewire DMA when the screen is locked if you are running Filevault, or if you have an EFI password.

[Sanddancer]

Yes it does matter, as the OS has to set up the DMA channels, etc.

[loeg]

No. It's direct DMA from the hardware.

[calloc]

It does matter. The OS has to set up the device for DMA in the first place. If the device is never enumerated it just doesn't get access.