Basically I'm looking to see if my hypothesis is correct (that untrusted input passed through DMA buffers would allow a DMA-capable but IOMMU-restricted device to compromise the kernel).

@MechMK1 It's not always about bias. If the RNG is seeded using the current time, which is common for low-quality RNGs, then the keyspace, no matter how many characters are in the password, is severely limited, enough that exhaustive search becomes practical.

webmin.com/exploit.html

HAHA

I've never liked webmin, so this just makes me laugh. :D

@Xander That isn't true. Rainbow tables are still useful for certain ciphers, like A5/1.

Also, rainbow tables are still valuable for WPA2, since the ESSID is used as the salt.

And, as we all know, a lot of people just use the default name "linksys" as their ESSID. :P

@Xander To put it into perspective, it would take some hundred thousand high-end CPU years to break A5/1, but it takes a negligible amount of time with a several TiB rainbow table.

@forest It's generally true. Of course there will always be weird edge cases.