Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

thunderspy.io

Post reply on HN
Print view View original

11–20 of 109 posts

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#11

Post by ashtonkem »

dataflow wrote: post #3

> there is no malicious piece of hardware that the attacker tricks you into using > All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware. Just started reading, but the comparison is already a little bizarre. It almost seems like the digital version of "This murderer is on the loose and you're in danger! He doesn't need to inject poison into your food. All he ne…

As a general rule, anyone with physical access to your machine already owns it. Physical security matters, a lot.

That being said, malicious hardware is a problem. A hacked phone charging terminal at the airport could certainly be a serious problem if there are enough vulnerabilities in the USB stack.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#12

Post by ashtonkem »

justaguyonline wrote: post #5

What would it take to have a Thunderbolt/USB C condom? You know, like those standard USB adapter that just drops the data leads on a usb charger to make attacks like this impossible. Maybe we would have to implement a hardware switch on the device itself? I'm not going to feel safe charging with a public use charger until I find some way to insure only power and not data is making it to my device. Even POE feels like…

I just bring my own brick for such circumstances. It takes no effort for me to evaluate the security, and it’s more flexible than counting on built in USB ports.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#13

Post by kichik »

dataflow wrote: post #3

> there is no malicious piece of hardware that the attacker tricks you into using > All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware. Just started reading, but the comparison is already a little bizarre. It almost seems like the digital version of "This murderer is on the loose and you're in danger! He doesn't need to inject poison into your food. All he ne…

If all it takes is a malicious Thunderbolt device, why is a screwdriver needed?

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#14

Post by tptacek »

jonhohle wrote: post #9
person_of_color wrote: post #6

Really though, if an attacker has unencumbered access to one’s device, all security goes flying out the window. The website is highly self-promoting.

As another commenter pointed out, public charging or borrowed chargers are an issue. Think airport charging kiosks/counters. Maybe power over data connectors isn’t the best idea (I enjoy single cable docking, but an extra, magnetic power cable wasn’t that much more work).

Borrowed chargers aren't the threat model here; these attacks involve an attacker opening up your machine and reading the contents of the TB3 controller's SPI flash.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#15

Post by tptacek »

kichik wrote: post #13
dataflow wrote: post #3

> there is no malicious piece of hardware that the attacker tricks you into using > All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware. Just started reading, but the comparison is already a little bizarre. It almost seems like the digital version of "This murderer is on the loose and you're in danger! He doesn't need to inject poison into your food. All he ne…

If all it takes is a malicious Thunderbolt device, why is a screwdriver needed?

Because they need to open up the victim's device to read its TB3 configuration directly off the SPI flash that holds it; that's how they get the malicious device to work in the first place.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#16

Post by mappu »

person_of_color wrote: post #6

Really though, if an attacker has unencumbered access to one’s device, all security goes flying out the window. The website is highly self-promoting.

> if an attacker has unencumbered access to one’s device, all security goes flying out the window

This is rapidly starting to become less true - full disk encryption is everywhere, backed by hardware TPMs; the Lockdown LSM prevents root from owing the boot chain; devices with soldered RAM are functionally immune to cold boot attacks.

There are still things an attacker can do - put a hardware keylogger on the keyboard wires, a skimmer on the fingerprint reader - but that requires future input from the victim. It is feasible today to defend against a physical attacker if you have the right hardware upfront and don't use it after the attack.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#17

Post by lidHanteyk »

dataflow wrote: post #3

> there is no malicious piece of hardware that the attacker tricks you into using > All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware. Just started reading, but the comparison is already a little bizarre. It almost seems like the digital version of "This murderer is on the loose and you're in danger! He doesn't need to inject poison into your food. All he ne…

What they're trying to get across is that this is not a Bad USB [0] attack, but an Evil Maid [1] attack. In either case, the attacker does not need to rush. To commit a Bad USB attack, the attacker deputizes you and uses your confusion [2] to get you to insert a dangerous peripheral device, on your own time. In an Evil Maid attack, the attacker patiently waits until you trust (read as: "are vulnerable to") their physical presence, and then inserts a dangerous peripheral device.

To use your analogy, in the former case, the murderer poisoned your food at the grocer's, and you unwittingly dose yourself when you make your meal. In the latter case, the murderer spends time getting to know you and letting you trust them, and then one day, when you go to the bathroom, they come in and shoot you like Vincent Vega.

[0] https://en.wikipedia.org/wiki/USB_flash_drive#BadUSB

[1] https://en.wikipedia.org/wiki/Evil_maid_attack

[2] http://www.cap-lore.com/CapTheory/ConfusedDeputy.html

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#20

Post by userbinator »

mappu wrote: post #16
person_of_color wrote: post #6

Really though, if an attacker has unencumbered access to one’s device, all security goes flying out the window. The website is highly self-promoting.

> if an attacker has unencumbered access to one’s device, all security goes flying out the window This is rapidly starting to become less true - full disk encryption is everywhere, backed by hardware TPMs; the Lockdown LSM prevents root from owing the boot chain; devices with soldered RAM are functionally immune to cold boot attacks. There are still things an attacker can do - put a hardware keylogger on the keyboard…

This is rapidly starting to become less true

Unfortunately, both for right-to-repair and actually owning the hardware you bought.

Post reply on HN