Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

thunderspy.io

Post reply on HN
Print view View original

71–80 of 109 posts

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#71

Post by oefnak »

ogre_codes wrote: post #67
tptacek wrote: post #10

I skimmed the paper and while the research looks solid, just in terms of the digging they did and the documentation they're providing, this website really buries its lede: if you've got a Macbook running macOS, the Macbook IOMMU breaks the DMA attack, which is the thing you're actually worried about here. Additionally, regardless of the OS you run, Macbooks aren't affected by the Security Level/SPI flash hacks they c…

Yes, buries the lede indeed. "THUNDERBOLT IS HOPELESSLY INSECURE AND BROKEN!!" blah blah blah blah * except on 90% of computers shipping with Thunderbolt. Windows PC makers were much later to TB3 and even now only ship it on a small percentage of their computers. I'm not even sure there is a Linux out of the box system with TB3 support.

Dell XPS 15 can ship with Linux.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#72

Post by [deleted] »

tptacek wrote: post #14
jonhohle wrote: post #9

Earlier quoted context omitted.

As another commenter pointed out, public charging or borrowed chargers are an issue. Think airport charging kiosks/counters. Maybe power over data connectors isn’t the best idea (I enjoy single cable docking, but an extra, magnetic power cable wasn’t that much more work).

Borrowed chargers aren't the threat model here; these attacks involve an attacker opening up your machine and reading the contents of the TB3 controller's SPI flash.

[deleted]

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#73

Post by [deleted] »

tptacek wrote: post #65
graton wrote: post #63

I wonder if that could be used by used sellers of MacBooks to get into the computers. https://www.vice.com/en_us/article/akw558/apples-t2-security... I guess MacBook resellers sometimes get computers where the password has been set and they can't get into the computers. I imagine they would be motivated to find anyway they can to unlock the computers.

No; for Macbooks, this work reduces to BadUSB.

[deleted]

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#74

Post by [deleted] »

zokier wrote: post #69
dannyw wrote: post #28

Earlier quoted context omitted.

How about a SSH-like “trust on first use” prompt for all data connections? Each USB/TB device has its own pub/private keypair. If you ever plug in a charging cable and get the prompt, you know something is wrong.

That is exactly what TB has. The problem is that the device private key (in many(/all?) devices) sits in the flash memory completely unprotected so anyone can clone it.

[deleted]

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#75

Post by redactions »

tptacek wrote: post #10

I skimmed the paper and while the research looks solid, just in terms of the digging they did and the documentation they're providing, this website really buries its lede: if you've got a Macbook running macOS, the Macbook IOMMU breaks the DMA attack, which is the thing you're actually worried about here. Additionally, regardless of the OS you run, Macbooks aren't affected by the Security Level/SPI flash hacks they c…

This only holds for Macbooks running MacOS. It will not be protected by the IOMMU if the system uses Bootcamp with Windows or another operating system such as Linux.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#76

Post by redactions »

zokier wrote: post #69
dannyw wrote: post #28

Earlier quoted context omitted.

How about a SSH-like “trust on first use” prompt for all data connections? Each USB/TB device has its own pub/private keypair. If you ever plug in a charging cable and get the prompt, you know something is wrong.

That is exactly what TB has. The problem is that the device private key (in many(/all?) devices) sits in the flash memory completely unprotected so anyone can clone it.

It is not like ssh at all. It is a problem that secrets are kept in the flash and it is also a problem that those secrets are sent over the untrusted channel.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#77

Post by redactions »

tptacek wrote: post #14
jonhohle wrote: post #9

Earlier quoted context omitted.

As another commenter pointed out, public charging or borrowed chargers are an issue. Think airport charging kiosks/counters. Maybe power over data connectors isn’t the best idea (I enjoy single cable docking, but an extra, magnetic power cable wasn’t that much more work).

Borrowed chargers aren't the threat model here; these attacks involve an attacker opening up your machine and reading the contents of the TB3 controller's SPI flash.

That isn't entirely accurate. The ability to clone a given device state gives access to any system which has authorized that cloned device. A borrowed thunderbolt device which is not the target machine may also be used to bypass security levels as a result. No need to open the laptop in that case. See section 3.1.1 and 3.1.3 in the report.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#78

Post by tinus_hn »

maxbond wrote: post #38
mjg59 wrote: post #26

Earlier quoted context omitted.

> As a general rule, anyone with physical access to your machine already owns it. People frequently say this, but never really explain it. As far as I can tell, it translates to "Nobody cares about physical security" - except it's clear that people /do/. Things like Boot Guard are only really relevant to physical attacks. DMA protection in firmware is only really relevant to physical attacks. It's extremely obvious t…

Physical access is just such a rich attack surface that keeping your computer away from malicious actors is the right and proper solution. An extreme example a pentester imparted to me once was, if someone could spend sufficient time alone with my laptop, they could remove my hard drive and insert it into an identical laptop with a hardware or firmware backdoor preinstalled. We were discussing nation-state adversarie…

Not that it is physically secure, but if your disk is encrypted using a key in the TPM chip you can’t just put it in another computer, it won’t boot.

If you have that kind of access it doesn’t really matter though because you can copy the drive, then add a device that monitors the keyboard so you get the key when the user enters it and then you can just clear or disable the TPM chip.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#79

Post by redactions »

tptacek wrote: post #15
kichik wrote: post #13

Earlier quoted context omitted.

If all it takes is a malicious Thunderbolt device, why is a screwdriver needed?

Because they need to open up the victim's device to read its TB3 configuration directly off the SPI flash that holds it; that's how they get the malicious device to work in the first place.

Many smaller devices do not require tools and are trivial to clone. Any of the victim devices will do. It's not only useful to attack a target computer.

Device identifiers and capabilities are not bound to the security level secret values. Drop off a pre-cloned video adapter in a conference room. If it is used and as a result authorized by a targeted computer at a later moment in time, it's game over. An attacker may now perform DMA operations unless the system has kDMA protection enabled. This requires kDMA support in the BIOS, IOMMU hardware, and in the Operating System.

The focus on DMA is however missing a very important observation about security levels from the research: There is a lot of attack surface when you're able to plug in a PCI(e) device as easily as a USB disk.

Re: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

#80

Post by mjg59 »

osy wrote: post #64
mjg59 wrote: post #50

Earlier quoted context omitted.

> they can also flash the BIOS SPI Boot Guard makes that impractical in most cases. The point here is that on machines that don't implement kernel DMA protection, you're able to drop the Thunderbolt config to the lowest security level and then write-protect the Thunderbolt SPI so the system firmware can't re-enable it, making it easier to perform a DMA attack over Thunderbolt and sidestep the Boot Guard protections.…

Boot Guard is not implemented on most (all?) self built machines and a lot of pre-builts as well. But even if it is enabled, UEFI variables are not protected at all. You can disable Secure Boot just by overwriting UEFI variables and then boot any arbitrary code from USB.

Which will change the measurements in PCR7, which is a detectable event that will break Bitlocker unsealing.
Post reply on HN