61–70 of 109 posts
Earlier quoted context omitted.
Last time Tunderbolt was broken (Thunderclap [1]), it was found that the Linux driver didn't activate the IOMMU. I assume that's since been fixed. [1] https://lwn.net/Articles/782381/
It seems to do that now: https://christian.kellner.me/2019/07/09/bolt-0-8-with-suppor...
I thought that this had changed with USB-C?!
https://www.vice.com/en_us/article/akw558/apples-t2-security...
I guess MacBook resellers sometimes get computers where the password has been set and they can't get into the computers. I imagine they would be motivated to find anyway they can to unlock the computers.
This is the kind of garbage that the infosec community often memes about. A marketing website, a domain name, a cute logo for a vanity project masquerading as security research. Basically every one of the "seven" vulnerabilities boils down to "if someone can flash the SPI of the thunderbolt controller then xxx" but if they can flash the TB SPI, then they can also flash the BIOS SPI which has a lot of the same "vulner…
> they can also flash the BIOS SPI Boot Guard makes that impractical in most cases. The point here is that on machines that don't implement kernel DMA protection, you're able to drop the Thunderbolt config to the lowest security level and then write-protect the Thunderbolt SPI so the system firmware can't re-enable it, making it easier to perform a DMA attack over Thunderbolt and sidestep the Boot Guard protections.…
I wonder if that could be used by used sellers of MacBooks to get into the computers. https://www.vice.com/en_us/article/akw558/apples-t2-security... I guess MacBook resellers sometimes get computers where the password has been set and they can't get into the computers. I imagine they would be motivated to find anyway they can to unlock the computers.
Earlier quoted context omitted.
USB power delivery does not use the data lines at all. It negotiates the permissible voltage and current using Vbus pin only. There's no reason why your USB data port needs to be enabled while charging. Just disable it. I actually have a charge-only thunderbolt cable in my desk ... it's incredibly irritating because the only way to tell the difference between it and a real thunderbolt cable is that it doesn't work.
Sounds like exactly what I was looking for, where did you pick it up?
I skimmed the paper and while the research looks solid, just in terms of the digging they did and the documentation they're providing, this website really buries its lede: if you've got a Macbook running macOS, the Macbook IOMMU breaks the DMA attack, which is the thing you're actually worried about here. Additionally, regardless of the OS you run, Macbooks aren't affected by the Security Level/SPI flash hacks they c…
"THUNDERBOLT IS HOPELESSLY INSECURE AND BROKEN!!"
blah
blah
blah
blah
* except on 90% of computers shipping with Thunderbolt.
Windows PC makers were much later to TB3 and even now only ship it on a small percentage of their computers. I'm not even sure there is a Linux out of the box system with TB3 support.
Earlier quoted context omitted.
> they could remove my hard drive and insert it into an identical laptop Does that make having a layer of stickers on one's laptop also a layer of defense?
Stickers are an inconvenience, especially when applied over a screw hole required for disassembly or similar, but it's not exactly cryptographically secure. What stops the attacker from buying the same sticker as you, or taking a good picture of it before destroying it and printing a new one off?
https://mullvad.net/en/help/how-tamper-protect-laptop/
- "Then we paint the border of the sticker with glittery polish. It's important with the glitter because the outcome will always be unique."
- "After the polish has dried, we take a high-resolution photo of each area."
What would it take to have a Thunderbolt/USB C condom? You know, like those standard USB adapter that just drops the data leads on a usb charger to make attacks like this impossible. Maybe we would have to implement a hardware switch on the device itself? I'm not going to feel safe charging with a public use charger until I find some way to insure only power and not data is making it to my device. Even POE feels like…
How about a SSH-like “trust on first use” prompt for all data connections? Each USB/TB device has its own pub/private keypair. If you ever plug in a charging cable and get the prompt, you know something is wrong.
Really though, if an attacker has unencumbered access to one’s device, all security goes flying out the window. The website is highly self-promoting.
> if an attacker has unencumbered access to one’s device, all security goes flying out the window This is rapidly starting to become less true - full disk encryption is everywhere, backed by hardware TPMs; the Lockdown LSM prevents root from owing the boot chain; devices with soldered RAM are functionally immune to cold boot attacks. There are still things an attacker can do - put a hardware keylogger on the keyboard…
The point still is that if the attacker has unencumbered access to your device then indeed _further_ use of the device is unrecommended to say the least. It doesn't matter if you had or did not have full disk encryption. It does not matter if you had or did not have Thunderbolt.
An extremely low tech solution would be to place a smallish and tactically hidden camera on the chassis, you don't even need the screwdriver for that. And it just happens all the time on ATMs and I'd bet that like on ATMs it would fool a shitton of people.
And this story is precisely about the type of attack that "requires further user input" -- what would be the point of requiring Thunderbolt at all in the first place if you already have the system in pieces?