Updated: Comment from Intel Added at the End.
Seven serious Thunderbolt security flaws have been discovered that affect Macs with both standalone Thunderbolt ports and those that use Thunderbolt-compatible USB-C ports used on modern Macs.
The vulnerabilities, which are present in all machines with Thunderbolt/Thunderbolt-compatible USB-C ports shipped between 2011 and 2020, allow an attacker to access data even when the machine is locked and even when the machine’s hard drive is encrypted.
Security researcher Björn Ruytenberg discovered seven vulnerabilities in Intel’s Thunderbolt chips, and nine ways to exploit them.
Users cannot tell when a machine has been compromised.
Thunderspy is stealth, meaning that you cannot find any traces of the attack. It does not require your involvement, i.e., there is no phishing link or malicious piece of hardware that the attacker tricks you into using. Thunderspy works even if you follow best security practices by locking or suspending your computer when leaving briefly, and if your system administrator has set up the device with Secure Boot, strong BIOS and operating system account passwords, and enabled full disk encryption. All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware.
These vulnerabilities lead to nine practical exploitation scenarios. In an evil maid threat model and varying Security Levels, we demonstrate the ability to create arbitrary Thunderbolt device identities, clone user-authorized Thunderbolt devices, and finally obtain PCIe connectivity to perform DMA attacks. In addition, we show unauthenticated overriding of Security Level configurations, including the ability to disable Thunderbolt security entirely, and restoring Thunderbolt connectivity if the system is restricted to exclusively passing through USB and/or DisplayPort. We conclude with demonstrating the ability to permanently disable Thunderbolt security and block all future firmware updates.
Macs running Bootcamp are fully vulnerable to all of the Thunderbolt security flaws, and they are “partly affected” when running macOS.
MacOS employs (i) an Apple-curated whitelist in place of Security Levels, and (ii) IOMMU virtualization when hardware and driver support is available. Vulnerabilities 2–3 enable bypassing the first protection measure, and fully compromising authenticity of Thunderbolt device metadata in MacOS “System Information”. However, the second protection measure remains functioning and hence prevents any further impact on victim system security via DMA. The system becomes vulnerable to attacks similar to BadUSB. Therefore, MacOS is partially affected.
While Ruytenberg has informed both Intel and Apple of his discoveries, the security flaws are present in the controller chips, meaning there is no way to fix the security holes via a software update.
Ruytenberg’s document discusses how the exploits can be pulled off. The document is available here.
Intel commented:
“This attack could not be successfully demonstrated on systems with Kernel DMA protection enabled. As always, we encourage everyone to follow good security practices, including preventing unauthorized physical access to computers.”
For more information on Intel’s comments, visit the Intel blog.
(Via 9to5Mac)