Direct Memory Access (DMA) is a technology that allows faster data transfer between individual pieces of hardware without burdening the central processing unit; it also creates potential vulnerabilities that can be exploited by attackers to gain unauthorised access to memory or other sensitive data.
The purpose of this thesis is to investigate DMA attacks targeting Windows operating systems. Several examples of attack execution are presented, including file system manipulation, memory dumping, shell creation on locked systems and reading the main memory. The necessary hardware and software tools, such as Screamer PCIe Squirrel and PCILeech, are analysed, in regards to their performance and limitations.
The task also includes a reccomendation for implementation of safeguards such as Secure Boot, DMA kernel protection and EDR systems, which aid in detecting and preventing these attacks.
|
