Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

thunderspy.io

Post reply on HN
Print view View original

51–60 of 109 posts

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#51

Post by AnthonyMouse »

mjg59 wrote: post #26
ashtonkem wrote: post #11

Earlier quoted context omitted.

As a general rule, anyone with physical access to your machine already owns it. Physical security matters, a lot. That being said, malicious hardware is a problem. A hacked phone charging terminal at the airport could certainly be a serious problem if there are enough vulnerabilities in the USB stack.

> As a general rule, anyone with physical access to your machine already owns it. People frequently say this, but never really explain it. As far as I can tell, it translates to "Nobody cares about physical security" - except it's clear that people /do/. Things like Boot Guard are only really relevant to physical attacks. DMA protection in firmware is only really relevant to physical attacks. It's extremely obvious t…

> DMA protection in firmware is only really relevant to physical attacks.

That's a different kind of attack than what people usually mean by "physical access" though. The thing where they drop a bunch of malicious flash drives in the parking lot or put a malicious USB charger in an airport isn't the same thing as the attacker having unsupervised physical access to the machine, and the former is certainly worth defending against even if the latter is hopeless.

> Things like Boot Guard are only really relevant to physical attacks.

One could argue that they are also relevant to purposely locking the device owner into specific operating systems.

As an example of "physical access and you're screwed," one way to compromise a machine is to install a microphone anywhere near the machine and then wait for the user to type their passphrase. It's possible to deduce what keys are being pressed from the sounds they make and the timing, so now the attacker has your passphrase. The same can be done with covert video surveillance.

Another possibility is to measure electromagnetic emissions to much the same effect. Most computer keyboards are not exactly TEMPEST certified and even if they were, someone with physical access could make adverse modifications.

Protecting a machine against unsophisticated attackers is pretty easy, to the point that the likes of Boot Guard are not even required, but protecting a machine against physical access by a sophisticated attacker is pretty hopeless.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#52

Post by AnthonyMouse »

mjg59 wrote: post #49
AnthonyMouse wrote: post #47

Earlier quoted context omitted.

Stickers are an inconvenience, especially when applied over a screw hole required for disassembly or similar, but it's not exactly cryptographically secure. What stops the attacker from buying the same sticker as you, or taking a good picture of it before destroying it and printing a new one off?

An example is using glitter-containing nail polish to cover the screws, taking a high resolution picture and then having an app that checks whether the glitter particles are still in the same position. There are companies selling solutions along these lines.

I guess at that point you're basically asking whether it's possible to make higher resolution printers than cameras, but considering you can in principle do printing using lithography similar to what they use to make semiconductors, that's probably going to win over the average phone camera. Although you're obviously then talking about a much more sophisticated attack.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#53

Post by erik_seaberg »

zinodaur wrote: post #41
mjg59 wrote: post #30

Earlier quoted context omitted.

And a thing you can do for machines that have built-in keyboards is refuse to enable new HID devices until the user provides affirmative consent. The people who have reason to care about these attacks have defenses, and research that demonstrates those defenses are incomplete is useful research.

Yeah thats a good point - I personally have the bad habit of clicking "yes" to that dialogue whenever I see it, since it does sometimes spuriously appear. I certainly wouldn't attempt a teardown of all of the equipment currently plugged into my machine when I saw a message like that. Do you know if HIDs can impersonate other HIDs? E.g., if you attached a dongle to a usb keyboard, could that dongle claim the identity…

This is why NT had a "secure attention key" (ctrl-alt-del) that couldn't be intercepted by an app that might try to display a fake login screen.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#54

Post by mjg59 »

AnthonyMouse wrote: post #52
mjg59 wrote: post #49

Earlier quoted context omitted.

An example is using glitter-containing nail polish to cover the screws, taking a high resolution picture and then having an app that checks whether the glitter particles are still in the same position. There are companies selling solutions along these lines.

I guess at that point you're basically asking whether it's possible to make higher resolution printers than cameras, but considering you can in principle do printing using lithography similar to what they use to make semiconductors, that's probably going to win over the average phone camera. Although you're obviously then talking about a much more sophisticated attack.

It's not just a matter of printing, it's a matter of placement. If you can carry equipment of that calibre into a hotel room and do the swap then that'll defeat things, but it's not clear that that's realistic.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#57

Post by znpy »

mjg59 wrote: post #49
AnthonyMouse wrote: post #47

Earlier quoted context omitted.

Stickers are an inconvenience, especially when applied over a screw hole required for disassembly or similar, but it's not exactly cryptographically secure. What stops the attacker from buying the same sticker as you, or taking a good picture of it before destroying it and printing a new one off?

An example is using glitter-containing nail polish to cover the screws, taking a high resolution picture and then having an app that checks whether the glitter particles are still in the same position. There are companies selling solutions along these lines.

First things first: lol.

After that: at this point it's easier to pay a random person to follow you and steal your whole bag/backpack and wallet and make it look like the usual theft.

Or just break into your house/office or whatever.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#58

Post by boxed »

tptacek wrote: post #15
kichik wrote: post #13

Earlier quoted context omitted.

If all it takes is a malicious Thunderbolt device, why is a screwdriver needed?

Because they need to open up the victim's device to read its TB3 configuration directly off the SPI flash that holds it; that's how they get the malicious device to work in the first place.

That seems a bit counter to "Thunderspy is stealth, meaning that you cannot find any traces of the attack". No traces on the computer sure, but breaking apart my screen might be possible to see.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#59

Post by withinboredom »

boxed wrote: post #58
tptacek wrote: post #15

Earlier quoted context omitted.

Because they need to open up the victim's device to read its TB3 configuration directly off the SPI flash that holds it; that's how they get the malicious device to work in the first place.

That seems a bit counter to "Thunderspy is stealth, meaning that you cannot find any traces of the attack". No traces on the computer sure, but breaking apart my screen might be possible to see.

Unless they opened it before you even receive the device.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#60

Post by munchbunny »

mjg59 wrote: post #26
ashtonkem wrote: post #11

Earlier quoted context omitted.

As a general rule, anyone with physical access to your machine already owns it. Physical security matters, a lot. That being said, malicious hardware is a problem. A hacked phone charging terminal at the airport could certainly be a serious problem if there are enough vulnerabilities in the USB stack.

> As a general rule, anyone with physical access to your machine already owns it. People frequently say this, but never really explain it. As far as I can tell, it translates to "Nobody cares about physical security" - except it's clear that people /do/. Things like Boot Guard are only really relevant to physical attacks. DMA protection in firmware is only really relevant to physical attacks. It's extremely obvious t…

It's not that nobody cares about physical security, it's that physical access opens up entire classes of attacks that aren't possible otherwise, like physical keyloggers and bridging airgaps.

If you follow defense in depth as a security architecture philosophy, which the industry does, then you still implement defenses against physical attacks, but you recognize that those defenses are either (1) defenses against opportunists, or (2) last ditch defenses.

Post reply on HN