Incredible how you can steal data via Thunderbolt once you've taken the PC apart, attached a flash programmer, rewritten the firmware...

It's possible to extract data from a computer via its Thunderbolt port – once you've got the case off, plugged in a flash programmer, and reprogrammed the controller's firmware to grant access.

This technique, dubbed Thunderspy, can be exploited even if the computer is locked or asleep, and can bypass disk encryption, and any BIOS or operating system-level passwords. It was found and documented by Björn Ruytenberg.

It does't matter if you use Windows, Linux, macOS, or whatever: the vulnerability lies at the hardware level, specifically inside Intel's Thunderbolt chipset present in millions of PCs built since 2011, including Apple Macs. And, if exploited just right, you may never know data was exfiltrated from your box as no trace of the theft would be left.

If you bought your computer last year, or more recently, a mechanism called Kernel DMA Protection made be present, which, we're told, partially mitigates Thunderspy. Intel has, according to Ruytenberg, said it will increase the security of its Thunderbolt controllers in future.

Before anyone blows up these findings, let's be frank: this is, for most people, more of a neat trick than infosec Armageddon. A miscreant would need to have physical access to the machine long enough to unscrew the case, attach an SPI flash programmer with an SOP8 clip to rewrite the Thunderbolt port controller's firmware to unlock access, and then attach a device to the interface to copy data via PCIe and DMA through the port, and then, if necessary, flash back the original firmware and fit the computer back together.

It's not good news if you thought disk encryption, sleep states, and passwords would prevent someone from siphoning your data after stealing or seizing your computer for even just a few minutes. It's not bad news if your threat model already assumed physical access was a game-over scenario. It's not something that can be exploited over the internet or network, or by malware running on your PC or Mac.

Below is a video of Thunderspy in practice:

Youtube Video

It's all possible because Intel's Thunderbolt controllers have a concept of security levels, which govern which devices are authorized to access the interface port, and that it is possible to rewrite the chipset firmware to lower the configured level to zero, so that any attached device is trusted. Thus, with security disabled, a miscreant can plug in a Thunderbolt device that copies the contents of memory via DMA and PCIe.

It's also possible, once you're inside the computer, to use Thunderspy to authorize additional Thunderbolt devices that can later be plugged in to extract data, or clone user-authorized devices to copy out information.

"Being PCIe-based, Thunderbolt devices possess Direct Memory Access (DMA)-enabled I/O," Ruytenberg said. "In an evil maid DMA attack, where adversaries obtain brief physical access to the victim system, Thunderbolt has been shown to be a viable entry point in stealing data from encrypted drives and reading and writing all of system memory."

"All Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable," Ruytenberg continued, adding that the flaws can only be completely mitigated by redesigning and replacing the chips involved.

"Some systems providing Kernel DMA Protection, shipping since 2019, are partially vulnerable. The Thunderspy vulnerabilities cannot be fixed in software, impact future standards such as USB 4 and Thunderbolt 4, and will require a silicon redesign."

Ruytenberg said he privately tipped off Intel and Apple earlier this year about his findings, and the pair have so far declined to publicly commit to fixing the issue in already-shipped computers.

"Despite our repeated efforts, the rationale to Intel's decision not to mitigate the Thunderspy vulnerabilities on in-market systems remains unknown," he said. "Given the nature of Thunderspy, however, we believe it would be reasonable to assume these cannot be fixed and require a silicon redesign. Indeed, for future systems implementing Thunderbolt technology, Intel has stated they will incorporate additional hardware protections."

Apple argued macOS protects users, though Ruytenberg said the operating system only provides partial protection. To workaround the shortcomings on vulnerable systems, it's recommended you "ensure appropriate physical security when storing your system and any Thunderbolt devices, including Thunderbolt-powered displays," and "consider using hibernation (Suspend-to-Disk) or powering off the system completely. Specifically, avoid using sleep mode (Suspend-to-RAM)."

Intel has yet to respond to a request for comment. ®