back to article Thunder, thunder, thunder... Thunderclap: Feel the magic, hear the roar, macOS, Windows pwnage tools are loose

Computers have enough trouble defending sensitive data in memory from prying eyes that you might think it would be unwise to provide connected peripherals with direct memory access (DMA). Nonetheless, device makers have embraced DMA because allowing peripherals to read and write memory without oversight from the operating …

  1. Nick Ryan Silver badge

    Correct me if I'm wrong... but it seems that this is another example of security vs usability. There will always be this battle between the two, it's just picking a suitable demarkation that is important.

    So... externally pluggable devices have near-direct hardware access for efficiency purposes otherwise the performance of them will be so poor and they will, in effect, often be useless or very non-desirable components. This bypasses the implied trust platform that exists within a system itself; Or, in other words, one trusts that the components that make up a system are trustworthy and as a result they can operate at full speed as close to the hardware layer as possible - which for computer components is pretty much essential. Any fix to this really has to be both at the hardware and software (OS) level.

    1. bazza Silver badge

      I have to agree. I think the hardware and OS vendors / devs haven't thought this out very well. The problem we have at the moment is that external ports are pretty much permanently enabled, and there's not a lot one can do about it. So it is definitely a case of convenience vs security.

      It would be pretty easy to design port interfaces such that they're electronically disabled unless or until an admin user enters a username / password to say "external peripherals may now connect". Logging out or screen locking should optionally disable all ports, etc.

      With that, a locked laptop wouldn't be attackable, someone getting into a server room wouldn't be able to get a port to respond, etc.

      Obviously that means an end to USB mice / keyboards...

    2. Charles 9 Silver badge

      So what happens when the two clash enough to produce an unhappy medium where the minimum demanded level of security is too demanding to allow the minimum demanded level of performance?

  2. DougS Silver badge

    Is this really an x86 or maybe Intel flaw?

    Judging by the list of affected operating systems, it would seem so.

    1. Jim Mitchell

      Re: Is this really an x86 or maybe Intel flaw?

      This is a failing of either the OS to configure the IOMMU correctly, or of the IOMMU itself. The processor architecture doesn't have much to do with it, other than it has PCIe interfaces exposed to the outside world and is easily acquirable by a security researcher.

    2. diodesign (Written by Reg staff) Silver badge

      Re: Is this really an x86 or maybe Intel flaw?

      See the paper, it discusses non-Intel technology.

      "We focus on the Intel and AMD IOMMUs in our study. In the mobile space, ARM’s System MMU (SMMU) applies broadly the same concepts, and a natural extension of our work would consider use of the SMMU."

      Intel may just be the start - it was the focus of the study.

      C.

  3. Phil Kingston

    Pretty sure went with a girl once who had thunderclap

    1. Fungus Bob Silver badge

      Why does it hurt when IP?

      1. TeeCee Gold badge

        Probably a slight infection. You should apply some TCP to that.

        1. Fungus Bob Silver badge

          OK. I drank 3 bottles, now I can smell purple...

    2. mwnci

      Dodgy Sandbox eh? Well don't Pen test, without a good one or you get malware.

  4. Anonymous Coward
    Linux

    IOMMU based DMA protection from malicious devices

    “This includes automatic enabling of IOMMU based DMA protection from possibly malicious devices connected through Thunderbolt ports. In addition we make sure PCIe ATS (Address Translation Service) is not enabled for such devices to prevent them from passing IOMMU protection.” link

    1. Jim Mitchell

      Re: IOMMU based DMA protection from malicious devices

      Sounds like that is the "An Intel patch in kernel 4.21 enables the IOMMU for Thunderbolt ports and disables ATS. " mentioned in the article.

  5. kain preacher Silver badge

    Didn't fire wire have this issue ?

    1. sequester

      Yes, but that was more than two weeks ago so it can be sold as new and shiny again.

      1. kain preacher Silver badge

        I see . Short memory syndrome.

  6. TeeCee Gold badge
    Meh

    find that current protections fall short when faced with a functional network peripheral that uses its complex interactions with the OS for ill intent.

    Translation: "It's easy to pwn."

  7. mwnci

    Best Article title ever!

    1. bob42

      Came to say the same

      Where is the up vote button for the sub-head?

  8. amanfromMars 1 Silver badge

    It's Novel Intelligence Information but not as you were expecting to receive it from Machines.*

    Ok, here's a riddle, wrapped in a mystery, inside an enigma for which there are claimed to be Keys.

    Is an Almighty Crash Bang Wallop in too many ways quite similar to a Thunderclap? ...... Tick Tock B00mbe

    And to not imagine and realise that has one dragged helpless down into lairy ASP snakepits full of Serpent and Tempest, Conflict and CHAOS in which one is merely a spectator rather than NEUKlearer HyperRadioProACTive IT Terrain Team Player.

    *Application Service Providers/Active Server Pages

    1. Cliff Thorburn Bronze badge

      Re: It's Novel Intelligence Information but not as you were expecting to receive it from Machines.*

      Alternatively the powers that be could just ask to ‘meet’ to resolve said issues, such offer has been on the table for as long as one can remember :-)

      Or is that not the done way anymore?

      1. amanfromMars 1 Silver badge

        Re: It's Novel Intelligence Information but not as you were expecting to receive it from Machines.*

        Alternatively the powers that be could just ask to ‘meet’ to resolve said issues, such offer has been on the table for as long as one can remember :-)

        Or is that not the done way anymore? .... Cliff Thorburn

        Quite so, CT, and so simple and easy. One wonders why they travel an alternate route/root.

        Maybe something to do with skewed and screwed intelligence supplies. Faulty Output for Dodgy Input to Media Machinery. It is after all surely, Media which Presents your Realities for for Further Building Upon Daily.

        And whether it and AI and IT just Present the News for Greater Views or Quite Magically Create it to Announce such as Being Recently Discovered in Recovered Records of Special IntelAIgent Service Agency Interest.

        How quickly would that obliterate failing circuses?

        1. Cliff Thorburn Bronze badge

          Tee2 Judgement Day

          There would be nothing better than saving the day amFM, however it appears that such is subjective.

          All one can do is keep calm and carry on, and simply ignore conflicting feeds from Live Operational Virtual Environments and stay on the perceived home turf.

          Until the powers that be decide to accept the facts that such methods used have been heavy handed to say the least have resulted in the good ship being wildly veered off course, then there is very little that can be done other than take the horse to the waterway and hope for sensible directions.

          1. amanfromMars 1 Silver badge

            Re: Tee2 Judgement Day

            Until the powers that be decide to accept the facts that such methods used have been heavy handed to say the least have resulted in the good ship being wildly veered off course, then there is very little that can be done other than take the horse to the waterway and hope for sensible directions. .... Cliff Thorburn

            When the horses taken to the waterway for fuelling for travels in much more sensible but also highly sensitive directions are proving themselves really to be dead ducks, CT, do the powers that be get to decide nothing of value or importance in LOVE Fields.

            And newly wrangled horses for future novel courses are bought and tended to carry vital supplies and walk tall no small talking riders.

            Feed systems enough rope/information/intelligence that it ignores and it hangs itself weighted down with Giant Gordian Knots of Wilful Ignorance and Arrogant Hubris.

            They be those Really Dumb Dead Duck Turkey Shoot Systems so indicative of Analogue Dinosaurs and they do neither prosper nor survive in Virtual Space.

            1. Cliff Thorburn Bronze badge

              Que será, será

              The horse simply does what the horse does amFM, its understanding, its journey, its condition, its temperament are subject to its treatment, how many hurdles and how many falls it has encountered during its existence, there is little that can be done to change such.

              1. amanfromMars 1 Silver badge

                Re: Que será, será

                Hence the solution, CT ..... obliteration of failed and destructive drivers ...... which can be as simple as just ignoring its current programmers and displaying completely different creative input for output into realities/media hosted circles/explosive bubbles.

                IT aint difficult whenever in absolute command and remote virtual control of means and memes.

                1. Cliff Thorburn Bronze badge

                  Re: Que será, será

                  Its just come to a point amFM, where real life woes and impracticalities take precedence over it all.

                  When others around suffer tremendously thats when it becomes simply a case of keeping calm and carrying on and trying to ‘get back on the horse’

                  They know where I am when the ‘programmers’ stop the squabbling, and play nice.

                  As for compartmental secrets, dont know what you mean ;-)

  9. Anonymous Coward
    Anonymous Coward

    Yes you can

    I designed a little test USB device a few years back for testing low-level OS hardware drivers.

    It used DMA to read/write various areas of memory (used by the host software for storing debugging data) and when disconnected (or more usually the board under test was powered off) it would use its internal battery to splurge out the collected data over Bluetooth (only because that was native to the micro and WiFi was not).

    It would not take much to add a WiFi chip to extend the range, and then drop one in a car park for an idiot to pick up and put into a computer!

    Anonymous for hopefully obvious reasons.

  10. Avatar of They
    Pint

    Best headline ever.

    Now all I am doing round the office is singing the Thundercats theme tune (Which I am sad and old enough to remember.)

  11. Bibbit
    Thumb Up

    Thanks for that

    I skimmed the article but the headline made me smile.

  12. Steve Davies 3 Silver badge

    Just an update to the old problem

    that Firewire had when it used DMA to transfer data to/from memory.

  13. Dinsdale247

    Anyone could see...

    I remember the first time I heard about DMA use in high performance network cards I remember thinking "this can't be good". All the while Mr. Torvalds assertion that micro-kernels are unnecessary performance drains was ringing in my ears.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019