Home

Podfeet Podcasts

Security Bits Logo no alpha channel

Security Bits — 17 May 2020

  • by Bart Busschots
  • One Comment

    • Feedback & Followups

    Deep Dive — The ThunderSpy Thunderbolt Vulnerabilities

    TL;DR None of these exploits can be carried out remotely, all require physical access, but, they do let attackers extract the contents of your computer’s RAM, and that’s extremely dangerous. The only protection is to physically block the port, or, to always power your computer down rather than putting it to sleep while it’s out of your sight. PCs are much more badly affected than Macs unless you use Bootcamp, in which case you’re completely open to attack while booted into Windows or Linux on your Mac. These vulnerabilities leave important people exposed, but are unlikely to affect regular folks.

    Security researcher Björn Ruytenberg from the Eindhoven University of Technology has released a paper detailing seven vulnerabilities in Thunderbolt, and to help make them easier to talk about (or to get more media attention), he’s given these bugs the catchy name Thunderspy.

    Thunderbolt’s big selling point is its speed, and it can achieve that because it has something called Direct Memory Access, or DMA. In effect, Thunderbolt connectors are low-level system busses projected off the motherboard and out into the big bad world. DMA allows Thunderbolt to access RAM without asking the CPU for help or permission! That is inherently dangerous, and the only way to provide any protection is to apply some kind of low-level fire-walling or filtering right on the Thunderbolt controller.

    The Thunderbolt spec allows OSes to enable some fire-walling of Thunderbolt DMA, but unfortunately for PC users, Apple are the only OS vendor to deploy support for these features, at least for now. This is why Macs are less susceptible to these bugs.

    Before we look at the bugs themselves, it’s important to underline the danger un-fettered DMA poses — an attacker can literally read all the RAM from your computer through your Thunderbolt port! That means every key and password in RAM can be read, including the keys for things like full disk encryption, and the private keys for any asymmetric encryption you’re using at the time of the attack.

    The only protection is to have nothing in RAM, and the only way to achieve that is to shut the computer down rather than putting it to sleep.

    All Thunderbolt controllers are made by Intel, and unfortunately, Intel have not done a great job implementing Thunderbolt. The problems fall into two categories:

    1. The specification does not provide any way cryptographic mechanism for digitally signing device metadata, so Thunderbolt devices can be trivially cloned. If your computer trusts a device, an attacker can make their evil hacking dongle appear to be your trusted device.
    2. While the specification does support digitally signed firmware, Intel’s implementation does a really bad job of checking the signatures, so, while it shouldn’t be possible to put malicious firmware on Thunderbolt connectors, it actually is.

    There is no way to fix the first problem without re-designing the specification, so the best we can hope for there is that Thunderbolt 4 addresses this problem.

    The second category if problems could be fixed with better Thunderbolt 2 & 3 controllers.

    These two different categories of flaw can be exploited in two different ways:

    1. Evil Maid Attacks — someone with physical knowledge but no technical access could exploit these vulnerabilities if they have access to both the target computer, and a Thunderbolt device trusted by that computer (like a monitor or a dock). The evil maid would also need to have been given some kind of hardware hacking tool by the mastermind behind the attack. The attack would have two steps:
      1. Plug the trusted device into the hacking tool so it can clone the metadata
      2. Plug the hacking tool into the target computer while it is on or asleep.
    2. Evil Techie Attacks — someone with physical access, some tools, and a lot of expertise could open the computer, find the Thunderbolt controller, connect a hacking tool to it, and replace the firmware with malicious firmware.

    So, just to reiterate, the only reliable defence from both of these scenarios is to keep your computer powered down when it’s out of your physical control. For regular people that probably only comes into play when crossing borders into or out of countries with governments you don’t trust. For high-value targets, that’s something they’ll always need to bear in mind.

    Macs are Less Affected than PCs?

    According to the paper, all Mac and PC hardware with Thunderbolt 2 or Thunderbolt 3 are equally affected, there are no secure Thunderbolt chips available.

    When it comes to OSes though things are a little more complicated.

    For both Windows and Linux running on PC hardware, the picture is very simple — they are susceptible to all the vulnerabilities except the Bootcamp one.

    On Macs running macOS things are a lot better (quote from the research paper):

    Regarding Thunderbolt security, macOS employs (i) an Apple-curated whitelist in place of Security Levels, and (ii) IOMMU virtualization when hardware and driver support is available. Vulnerabilities 2–3 enable bypassing the first protection measure, and fully compromising authenticity of Thunderbolt device metadata in macOS System Information [app]. However, the second protection measure remains functioning and hence prevents any further impact on victim system security via DMA. The system becomes vulnerable to attacks similar to BadUSB. Therefore, MacOS is partially affected.

    When you throw Bootcamp into the mix things become more complicated though. Rather than try to explain it I’ll just quote this table from the research paper:

    Vulnerabilities affecting Apple Mac systems when running macOS, as well as Windows and Linux when using Boot Camp:

    Vulnerability ID Affects MacOS Affects Windows Affects Linux
    1 No Yes Yes
    2 Partially Yes Yes
    3 Partially Yes Yes
    4 No Yes Yes
    5 No No No
    6 No No No
    7 No Yes Yes

    The Bottom Line

    If your computer has Thunderbolt 2 or 3, and it’s going to be out of your control in an environment where you have reason to worry someone might try to extract data from it, power it down, don’t just put it to sleep.

    Links

    ❗ Action Alerts

    Worthy Warnings

    Notable News

    Top Tips

    Interesting Insights

    Just Because it’s Cool 😎

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.

    1 thought on “Security Bits — 17 May 2020”

    1. Kurt Liebezeit - May 28, 2020

      Just an FYI, there is a slightly less advanced version of the Microsoft Quick Assist app built into earlier versions of Windows (such as Windows 7). And in fact, Windows 10 includes the older version as a separate executable (“Windows Remote Assistant”) in order to give some backwards compatibility. Howtogeek runs through the scenarios:

      https://www.howtogeek.com/268808/how-to-use-windows-10s-quick-assist-to-remotely-troubleshoot-a-friends-pc/

      Kurt

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top