Jump to content
Can't remember your login details? Read more... ×
Sign in to follow this  
Jeruselem

Thunderspy vulnerability

Recommended Posts

Anyone here using Thunderbolt and Intel systems? There's a nasty vulnerability with Thunderbolt!

https://thunderspy.io/

https://www.techpowerup.com/266917/unfixable-flaw-found-in-thunderbolt-port-that-unlocks-any-pc-in-less-than-5-minutes

 

The good news is to execute this, the person needs actual possession of your machine so it's not over the Internets thing.

 

 

Share this post


Link to post
Share on other sites

Thunderbolt by (lack of) design was vulnerable from the onset and it's been known for some time.

 

The problem with plenty of Macs is that the firmware allows Thunderbolt devices to perform early initialisation in a privelaged state and additional to that, flashing of the Bios on the computer and device is allowed as well.

Problem 2 is that you can be compromised and never know it.

So in reality, just having access to your TB peripheral for a minute can be sufficient to get eventual access to your computer.

  • Like 1

Share this post


Link to post
Share on other sites
Posted (edited)

Microsoft refused to put ThunderBolt on their surface machines, and this is why.

Now all the Macs with ThunderBolt will have trouble because they didn't complete patch the issue.

 

Most people don't have it anyway, it seems a few select non-Apple laptops do.

Edited by Jeruselem

Share this post


Link to post
Share on other sites

It's a good interface in that it also incorporates mini DVI (older variants) so adaptors can supply all the common video types (even old VGA DE-15)

And it's fast, so USB 2 equipped machines could use a USB 3 hub.

 

But addons tend to be pricey.  And the security issues.

But it's a problem of how it was implemented, and that comes down to the individual laptop maker.  The attacks are option-Rom and DMA based.  DMA attacks can be overcome by a proper IOMMU implementation.

It now shares the physical USB-C connector, so will be around for a while.

  • Like 1

Share this post


Link to post
Share on other sites

I guess most laptops out there aren't affected as most USB C out there is only 3.1 or 3.2 without TB.

This is one affecting pretty much most Mac laptops of recent times!

 

  • MacBook Pro introduced in 2016 or later.
  • MacBook Air introduced in 2018or later.
  • iMac introduced in 2017 or later.
  • iMac Pro (all models)
  • Mac mini introduced in 2018.
  • Mac Pro introduced in 2019.

Share this post


Link to post
Share on other sites

I think it can go back even further but some were supposedly fixed with firmware updates to the computer.

But a compromised machine can supposedly actually prevent further updates.

You can have a peripheral that can infect a machine powered on with it inserted and never know it.

 

But for what it is, it seems to be one of those exploits that's been talked about a fair bit but I've not really heard of anyone suffering loss due to it.

I had a repeat business customer call me out about it but there was little I could do.  Researched first and told him of what I found, but there seemed at the time there was little to nothing in the way of utlities to detect anything wrong.

 

All pretty stupid really, the easy way to protect firmware from dodgy updates in their case is use of certificates, as supposedly the EFI has to unlock it to enable flashing.

But anyhow, this is Apple and they have the automatic blessing of most of their users that they never get malware or buggy OS updates.

Share this post


Link to post
Share on other sites

Well, at work we have ONE laptop with Thunderbolt. So this has like zero effect as the laptop sits in the user's house most of the time.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×