Thunderbolt Flaws Expose Millions of PCs to Hands-On Hacking – locking unattended devices won't help

guest · May 10, 2020

Thunderbolt Flaws Expose Millions of PCs to Hands-On Hacking
The so-called Thunderspy attack takes less than five minutes to pull off with physical access to a device, and affects any PC manufactured before 2019
May 10, 2020
https://www.wired.com/story/thunderspy-thunderbolt-evil-maid-hacking/

Now one Dutch researcher has demonstrated how that sort of physical access hacking can be pulled off in an ultra-common component: The Intel Thunderbolt port found in millions of PCs.

On Sunday, Eindhoven University of Technology researcher Björn Ruytenberg revealed the details of a new attack method he's calling Thunderspy. On Thunderbolt-enabled Windows or Linux PCs manufactured before 2019, his technique can bypass the login screen of a sleeping or locked computer—and even its hard disk encryption—to gain full access to the computer's data.
That opens a new avenue to what the security industry calls an "evil maid attack," [...]

"All the evil maid needs to do is unscrew the backplate, attach a device momentarily, reprogram the firmware, reattach the backplate, and the evil maid gets full access to the laptop," says Ruytenberg, who plans to present his Thunderspy research at the Black Hat security conference this summer [...]
Click to expand...

Return of the Evil Maid

"I analyzed the firmware and found that it contains the security state of the controller," Ruytenberg says. "And so I developed methods to change that security state to 'none.' So basically disabling all security."
The full attack Ruytenberg shows in his demo video uses only about $400 dollars worth of equipment, he says, but requires an SPI programmer device and a $200 peripheral that can be plugged into a Thunderbolt port to carry out the direct memory attack that bypasses the lockscreen, like the AKiTiO PCIe Expansion Box Ruytenberg used.
Click to expand...

Thunderspy - When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

Thunderspy targets devices with a Thunderbolt port. If your computer has such a port, an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep.

We have found 7 vulnerabilities in Intel’s design and developed 9 realistic scenarios how these could be exploited by a malicious entity to get access to your system, past the defenses that Intel had set up for your protection.
We have developed a free and open-source tool, Spycheck, to determine if your system is vulnerable. If it is found to be vulnerable, Spycheck will guide you to recommendations on how to help protect your system.
Click to expand...

mirimir · May 11, 2020

Yeah, so epoxy everything except USB, and limit USB to at most v2 (but v1 is safer).

guest · May 11, 2020

Intel Confirms "Thunderspy" Risk in Thunderbolt Devices
May 11, 2020
https://www.cdrinfo.com/d7/content/intel-confirms-thunderspy-risk-thuerbolt-devices

A Thunderbolt flaw could let hackers steal your data within minutes, and grab encrypted data even if you lock your PC.

Attackers could steal data from Thunderbolt-equipped PCs or Linux computers, even if the computer is locked and the data encrypted, according to security researcher Björn Ruytenberg. Using a simple technique called “Thunderspy,” someone with physical access to your machine could nab your data in just five minutes with a screwdriver and “easily portable hardware,” he wrote.
In 2019, major operating systems implemented Kernel Direct Memory Access (DMA) protection to mitigate against attacks such as these.

However, that protection is only available on computers made in 2019 and later.
Click to expand...

Intel suggests users should check with their system manufacturers to determine if their system has these mitigations incorporated. For all systems, Intel recommends following standard security practices, including the use of only trusted peripherals and preventing unauthorized physical access to computers.
To protect yourself, you should “avoid leaving your system unattended while powered on, even if screenlocked,” Ruytenberg says, avoid using sleep mode and ensure the physical security of your Thunderbolt peripherals.
Click to expand...

Intel: More Information on Thunderbolt(TM) Security

guest · May 11, 2020

Major Thunderbolt security flaws found, affect Macs shipped 2011-2020
May 11, 2020
https://9to5mac.com/2020/05/11/thunderbolt-security-flaws/

The vulnerabilities are present in all machines with Thunderbolt/Thunderbolt-compatible USB-C ports shipped between 2011 and 2020.
There is no way to detect that a machine has been compromised.

"Thunderspy is stealth, meaning that you cannot find any traces of the attack. It does not require your involvement, i.e., there is no phishing link or malicious piece of hardware that the attacker tricks you into using. Thunderspy works even if you follow best security practices by locking or suspending your computer when leaving briefly, and if your system administrator has set up the device with Secure Boot, strong BIOS and operating system account passwords, and enabled full disk encryption. [...]"
Macs are fully vulnerable to all of the Thunderbolt security flaws when running Bootcamp, and ‘partly affected’ when running macOS.

Further details of the Mac vulnerabilities can be found below.
Ruytenberg informed both Intel and Apple of his discoveries, but says that as the Thunderbolt security flaws are present in the controller chips, there is no way to fix the vulnerabilities via a software update.
Click to expand...

Below is a description of how the vulnerabilities can be exploited on a Mac running macOS. This is essentially performed by fooling the Mac into thinking the attack kit is an Apple-approved Thunderbolt accessory.
Click to expand...

guest · May 11, 2020

Microsoft might have been right to skip Thunderbolt 3 (again) on the new Surface Book 3
May 11, 2020
https://www.notebookcheck.net/Micro...again-on-the-new-Surface-Book-3.464769.0.html

Just ahead of Microsoft’s Surface Book 3 launch, a leaked video presentation for the Surface 3 laptop shows a company exec reveal that its reason for avoiding Thunderbolt 3 has been because of security concerns.
Specifically, Thunderbolt 3 grants direct access to system memory and this is something Microsoft has wanted to avoid. Naturally, this raised alarm bells for the impending launch of the Surface Book 3 which was then on the immediate horizon.

Sure enough, when the Surface Book 3 was unveiled it last week, it once again omitted a Thunderbolt 3 port to the dismay of many Windows fans.
It is also a standard feature on many similar high-end notebooks, so what gives? [...]
Wired, in breaking the story, noted that Intel’s new Kernel DMA Protection feature [built following advice of the hack three months ago] needs to be enabled to protect against the attack. However, the response from OEMs varied as to whether is enabled by default on their machines.
Click to expand...

guest · May 12, 2020

Thunderspy: What it is, why it’s not scary, and what to do about it
Evil maids can use the Thunderbolt port to access your computer; many restrictions apply
May 12, 2020
https://arstechnica.com/information...is-why-its-not-scary-and-what-to-do-about-it/

There’s a new attack that uses off-the-shelf equipment to take full control of a PC—even when locked—if a hacker gets just a few minutes alone with it. The vector is a familiar one, the Thunderbolt ultrafast interface that connects graphics cards, storage systems, and other peripherals to millions of computers.

The hack, which took years to develop, is elegant. Its adept mix of cryptanalysis, reverse engineering, and exploit development punches a major hole in defenses that Thunderbolt creator Intel spent considerable time and resources to erect.
Ultimately, though, the technique is an incremental advance in an attack that’s existed for more than a decade.

While the weakness it exploits is real and should be closed, the vast majority of people—think 99 percent—shouldn’t worry about it. More about that later. For now, here are the bare-bones details.
Click to expand...

guest · Jul 30, 2020

Thunderspy attacks: What they are, who’s at greatest risk and how to stay safe
All you need to know about preventing adversaries from exploiting the recently disclosed vulnerabilities in the Thunderbolt interface
July 30, 2020
https://www.welivesecurity.com/2020...y-are-whos-at-greatest-risk-how-to-stay-safe/

In May 2020, Björn Ruytenberg, a computer security researcher at the Eindhoven University of Technology in the Netherlands, announced the discovery of Thunderspy, a series of vulnerabilities in the Thunderbolt technology and interrelated scenarios for changing – including disabling – the security level of the Thunderbolt interface on a computer and allowing an adversary with physical access to it to copy data off of it, even if full disk encryption (FDE) is used and the machine is locked with a password or sleeping in low-power mode.

While Ruytenberg’s research has (quite deservedly) received publicity because of its novel attack vector, not much has been said about how to protect against Thunderspy, or even determine whether you have been a victim. In this article, we will explore practical methods to defend against it, as well as anti-tamper steps that can help ascertain if a computer has been physically compromised.
Click to expand...

Note: Attacks such as those described by Ruytenberg are both highly-targeted and very rare compared to the types of attacks reported by ESET’s telemetry on a daily basis, and can sound like something out of a spy novel. [...]
For those people, following some of the admittedly draconian recommendations in this article can help reduce that risk. Regardless of your risk level, we hope you will find this information to be of use.
Click to expand...

Log in or Sign up

Thunderbolt Flaws Expose Millions of PCs to Hands-On Hacking – locking unattended devices won't help

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Thunderbolt Flaws Expose Millions of PCs to Hands-On Hacking – locking unattended devices won't help

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches