Monday, May 11th 2020
Unfixable Flaw Found in Thunderbolt Port that Unlocks any PC in Less Than 5 Minutes
Dutch researcher from the Eindhoven University of Technology has found a new vulnerability in Thunderbolt port that allows attackers with physical access to unlock any PC running Windows or Linux kernel-based OS in less than 5 minutes. The researcher of the university called Björn Ruytenberg found a method which he calls Thunderspy, which can bypass the login screen of any PC. This attack requires physical access to the device, which is, of course, dangerous on its own if left with a person of knowledge. The Thunderbolt port is a fast protocol, and part of the reason why it is so fast is that it partially allows direct access to computer memory. And anything that can access memory directly is a potential vulnerability.
The Thunderspy attack relies on just that. There is a feature built into the Thunderbolt firmware called "Security Level", which disallows access to untrusted devices or even turns off Thunderbolt port altogether. This feature would make the port be a simple USB or display output. However, the researcher has found a way to alter the firmware setting of Thunderbolt control chip in a way so it allows any device to access the PC. This procedure is done without any trace and OS can not detect that there was a change. From there, the magic happens. Using an SPI (Serial Peripheral Interface) programmer with a SOP8 clip that connects the pins of the programmer device to the controller, the attacker just runs a script from there. This procedure requires around $400 worth of hardware. Intel already put some protection last year for the Thunderbolt port called Kernel Direct Memory Access Protection, but that feature isn't implemented on PCs manufactured before 2019. And even starting from 2019, not all PC manufacturers implement the feature, so there is a wide group of devices vulnerable to this unfixable attack.
You can check out the video demonstration below:
Source:
Wired
The Thunderspy attack relies on just that. There is a feature built into the Thunderbolt firmware called "Security Level", which disallows access to untrusted devices or even turns off Thunderbolt port altogether. This feature would make the port be a simple USB or display output. However, the researcher has found a way to alter the firmware setting of Thunderbolt control chip in a way so it allows any device to access the PC. This procedure is done without any trace and OS can not detect that there was a change. From there, the magic happens. Using an SPI (Serial Peripheral Interface) programmer with a SOP8 clip that connects the pins of the programmer device to the controller, the attacker just runs a script from there. This procedure requires around $400 worth of hardware. Intel already put some protection last year for the Thunderbolt port called Kernel Direct Memory Access Protection, but that feature isn't implemented on PCs manufactured before 2019. And even starting from 2019, not all PC manufacturers implement the feature, so there is a wide group of devices vulnerable to this unfixable attack.
25 Comments on Unfixable Flaw Found in Thunderbolt Port that Unlocks any PC in Less Than 5 Minutes
Edit:
Also, article source that would be nice to link is the flaw's own site:
thunderspy.io/
slow news day eh ?
in other news people that have physical access to your computer can steal your data
article title is blately misleading its not 5 minutes try more like 15 minutes to get all the hardware setup probably closer to 20 if you need be fiddling with your hardware probe to get a solid connection anybody thats ever used these SOIC clips knows they are pain in the ass and depending on the board and the bios chip style you may not even have access
btw I can bypass the windows login screen by booting the pc from the windows setup disk and renaming a file witch btw requires no hardware mods no special software and in reality probably about 5 minutes
can we stop with the fear mongering please holy fuck its so easy to make the uneducated whip them selves into a panic
It was a joint Intel and Apple collaboration to develop, but Apple is the main one pushing it as a standard.
The real problem seems to be that there simply are not enough checks and verifications to properly detect incorrect firmware and at least raise an alarm if that is the case.
I will read more about this... if it truly does require host access and cable access, you will have quicker luck with the pcie vulnerabilities themselves as it has no security ....Thunderspy enables creating arbitrary Thunderbolt device identities and cloning user-authorized Thunderbolt devices, even in the presence of Security Levels pre-boot protection and cryptographic device authentication.
While the permanent disablement of security requires host disassembly and modification the other attack vectors do not. AKA, plug device into locked system and gain access. Universal key. Physical access is usually considered a moot point because it allows for removal of system and time constraints on attack vectors. However gaining network access through a locked system is a big deal, as it can be a supply chain attack or even a parkinglot attack, though I suspect people would be less likey to pick up a thunderbolt cable that has been tampered with than a usb key. That said, people are dumb.
You clearly lack a good understanding regarding the usefulness of these attacks. There are many many companies that go to great lengths with disk encryption and account lockout policies and in many regards this is a relatively inexpensive way to bypass most of those protective layers.
Is it unlikely? Sure you need physical access. But this not only opens up threats to third parties whom gain physical access but more importantly the growing number of insider threats that pop up year over year. Someone's "stolen" laptop could be from someone in their very company with regular access to the machine or knowledge of that employees whereabouts. This isn't fear mongering, this is a security orgs nightmare. A breach point with little or no hope of ever fixing. Many orgs will most likely move disk encryption to pre-boot authentication, but that comes with a cost to the end user experience and could have major functionality concerns for items like kiosks and publicly accessible endpoints. Thunderbolt is just broken.
I'll take academic exploits for $200, Alex.No one should be using FDE with only TPM or just autoboot as an auth method. If you are, I can bypass that login screen through several means, not just this. It's pretty darn trivial.
arstechnica.com/information-technology/2020/05/thunderspy-what-is-is-why-its-not-scary-and-what-to-do-about-it/you clearly don't have ANY understanding of OpSec
physical access for any length of time = game over you loose thats it you are done
if you have critical data stored locally and are NOT already using pre-boot authentication with full disk encryption you are an idiot and should have your hands cut off
you two options either don't give the machine access to critical data, or lock it down there is no middle ground between security and usability in this case
and most organisations don't even bother with disk encryption so again moot point if the data is stored locally
go away