Incredible how you can steal data via Thunderbolt once you've taken the PC apart, attached a flash programmer, rewritten the firmware... It's possible to extract data from a computer via its Thunderbolt port – once you've got the case off, plugged in a flash programmer, and reprogrammed the controller's firmware to grant access. This technique, dubbed Thunderspy, can be exploited even if the computer is locked or asleep, and can bypass disk encryption, and any …
Neat article, neat trick, but way too Mission Impossible for real life. I'll file this with the transmitting data via fan noise article.
Still, cheers to the boffins who figured this out. Although they do seem to have a lot of time on their hands. Probably in self quarantine.
It's quite serious if you take it from the perspective of state-run secrets, confiscations or political actions: if you are a political dissident, or arrested even on a trumped-up charge, and you thought that your password/encrypted data could not be used against you because they never will be able to get to it, this changes that outcome.
Corporate espionage on a stolen, yet encrypted, laptop? Done. Don't agree with our political agenda, refused boarding of your plane, and fishing for "evidence" on your locked laptop? Done. Even a simply confiscation of an attorney's, or an accountant's, records, with just a twinkle of a suspicion of fraud, but the prosecutor can't get the courts to agree to a full warrant? Done, and done (and fight about it in the courts but that's later, hopefully after that nice "guilty" verdict that sounds great in the news and on your resume as you run for higher office).
This is horrible news for anyone who used BIOS passwords or encryption in the first place.
Well, sort of. However, it does involve quite a bit of work to access the data, which means that it won't get used all that often. If it's a government doing the accessing, you end up in XKCD 538 territory. Similarly, it won't work unless the person has put the computer to sleep while the attacker has access to it. If it has been shut down or the battery died, the exploit produces nothing. So this also limits the viability of using that attack after the user has run away. The attack is also only needed if the user has encrypted their disks but hasn't done anything else to protect the data--if they also encrypt the file, the attack cannot get the cleartext of that file or the password, and if the user didn't encrypt the disk, then there is no need to do this.
While it's not useless, it only works in a relatively small number of cases, and in many of those cases, there is a more direct method of getting access. It's a good reminder to those who are concerned about an attacker of that level of skill and determination to avoid suspending to memory, but that has been known for some time.
"However, it does involve quite a bit of work to access the data,"
Just the opposite! Did anybody beyond myself actually read the white paper? I'll quote said paper:
"All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware."
Or did you watch the video??
5 minutes, you're DONE. The attack is almost completely automated: lift the back, attach an attack computer, reprogram, attach a Thunderbolt attack device, done.
The researchers even provided 2 tools they developed to assist the crack!
This isn't even difficult. And a *lot* of people use Sleep mode whilst traveling; for example, using the computer whilst awaiting boarding in the airport, then going into Sleep mode to awaken back on the plane.
You're leaving out some steps:
Steal laptop from user: If they're in the airport, they likely still have the machine right next to them. Good luck with that. Stealing it with enough time to do the rest of the steps and return it unnoticed usually requires them to leave it somewhere from where it can be lifted.
Dismantle laptop: This step is fast. Well, it's fast for my computer as long as you have the correct screwdriver, because you just have to undo all the screws and lift off the backplate. For a computer which uses a lot more glue, it'll be much slower to get at the thunderbolt interface pads.
Attach reprogrammer: This needs to be a reprogrammer that already has the code for this specific Thunderbolt chipset and is wired properly for the interface in the computer. So it's not one-size-fits-all. A criminal can't just carry a simple box that lets them do it to every computer, but a prepared attacker with knowledge of the computer involved can use it.
Upload code: That's fast too.
Connect memory access device to port: This one can be the same device for all victim machines.
Copy memory: Yes, copy memory. A lot of memory. I'm currently using about three gigabytes, and I don't even have much running. Sometimes I'm using eleven gigabytes because I've got VMs running. If you're after sensitive stuff, you want to catch me then because the VMs contain the sensitive information. You aren't going to copy eleven gigabytes onto your portable system in five minutes. Thunderbolt is fast, but you need to also factor in the disk speed of the thing you're righting to, the bus speed of your attack box, any processing you need to do while reading, any delays in getting the memory accessed by the laptop's chipset, and on and on. That takes time. Once again, even if you did manage to steal it from someone in an airport, you need to return it to them quickly. This will add potentially long delays.
Reflash original firmware: This may be optional if your replacement firmware can still operate correctly, but if it doesn't, you have to put back the original code so they won't notice something's wrong as soon as they plug in a different peripheral.
Reassemble computer: Fast for mine. Good luck with some others. See IFixit for details.
Clean evidence of tampering from computer: Oh, and nobody had better have seen you disassembling a laptop in another airport area, because I'm guessing they'd get suspicious about what you're doing there. Having security called to verify you aren't turning a laptop battery into an explosive device wouldn't be great for you.
Return computer to the place where you left it: The user needs to not have noticed that it was ever missing. They also need to not see you put it back. Have fun.
Again, it's not useless. It's not so easy as the paper makes out, though, because they only timed how long it takes to attach an exploit device and prove the exploit successful, not how long it takes from theft to replacement with useful usage of exploit in between.
It's common practice for law agencies, when planning to arrest someone on cyber-related charges, to do so when they are at their computer. This attack vector might be a handy tool for them in some situations - certainly it seems less faff than cryogenically freezing the RAM.
If you fall into the dissident category or other high risk user, if your machine has been compromised (i.e. outside of your sight for any period of time), you'll either use it for banal things or you'll physically destroy it and get another device.
Are nipping at the heels of circa 2000 MicroSoft. Bad idea layered upon bad idea, holes plugged with inscrutable goo, no traceability, vendors sidelined by the whims of their suppliers.
When people say ARM/RISC-V/... will never become mainstream serious, look to how intel completely lost their mind in a bid to shutdown competition. In the unlikely event that there was ever a full investigation of everything from Spectre forward, I am sure you will find a circa-1998 internal email saying something along the lines of "... and if we just ignore the privacy violation and speculatively treat the first level cache as a virtually indexed cache, we will hit 90% of mips/sparc/dec/... ", each of whom knowingly did the right thing.
At a point, it doesn't matter if the intel X is 1000x the ARM Y If the intel X is only suitable for hobby computers, it will inevitably find its niche.
"and if we just ignore the protection/privillege violation and speculatively treat the first level cache as a virtually indexed cache,"
That writeup's out there already. I wish I could remember where - it's not widely publicised, for obvious reasons. But here is a gross oversimplification of what I remember.
Look at x86 instructions and protection/privilege architecture (and typical system architecture) with a view to making the perrformance competitive. Preserving safety and security is not a goal.
Solution: Translate the x86 instructions (CISC, slow, awkward) to groups of RISC-like instructions on the fly. Any attributes of the executing code and of the data being accessed which are not contributing to getting the right answer quicker can be discarded as they're too troublesome and anyway Marketing don't need them.
So, access modes, exception handling, logical vs virtual addressing in caches, etc all go out of the Window.
As does any concept of secure (or indeed safe) code.
Some other readers must have seen the real writeups. Where was it?
Intel. The x86 company. Sell while you can.
El Reg: Before anyone blows up these findings …
The Independent: Major Computer Bug Means Millions Could Be At Risk Of Hack
I almost expect hardware manufacturers use this exploit as an excuse to for the use of glue in their laptops. Cheap cutting of corners during manufacture? Mais non!! We were thinking about security!!! Honest!!!!
Oh dear. I feel an extra exclamation mark coming up!!!!!
I'd better be going. The one with "Maskerade" in the pocket, please.
Glue doesn't save a lot of money over screws during manufacture because jigs and machines can be set up to do it. However, during end of life dismantling, glue saves a lot of human labor - and thus cost. And you don't end up with steel screws contaminating recovered Aluminium.
A pile of glued devices can be placed on a conveyor through an oven and then easily pulled apart afterwards. I've just counted twenty screws in the bottom of my old style laptop, heavens knows how many more inside - or how long it would take someone to reduce it to component parts.
I was thinking this exact thing -- It seemed to me that glue assembly in super-thin/small form factors meant you probably couldn't fit the requisite bits inside, anyway. It's likely to be your big, easily-repairable, modular machines that would be at most risk.
As evidenced by the impeccable research carried out to craft this plausible scene, NCIS is practically a hacking documentary.
Does the fact that an attack means opening up the PC/laptop means iMacs and MacBooks are reasonably safe - unless the attacker gets a job in an Apple store? The criticism of being difficult to repair or modify becomes an advantage :)
PS Rhetoric question, with tongue firmly in cheek!
This all boils down how feasible it is to re-write the Thunderbolt firmware (or more exactly, the NVRAM where the approved devices are listed) Apparently not too hard. And also obtaining a TB device that can be commanded to read or modify RAM.
1. What's to stop an attacker inserting data-stealing PCIe cards in office desktops or servers? Design the card as hot-pluggable and presto! Direct Memory Access. Alternatively PCIe M.2 cards can be used. Or hot-plug NVME slots. No need for the 're-write firmware' portion, unless the the PCIe/M.2 slots are disabled. Typically all slots are enabled at the factory.
2. Attach a data-stealing device between CPU and memory.
3. Attach a data-stealing device between CPU and PCIe, or any other bus with DMA.
4. Attach a keylogger into straight into USB traces on the mobo.
5. Monitor for "micro changes in air density" (Alien style) at the air intake to determine computer operation.
With advancing technology, any of those are becoming more and more feasible to do. Except the last one. Maybe.
... of "physical access = complete compromise modulo time".
And this tends to be even cheaper and easier with "Smartphones" (i.e. smallish pocket computers) than with the PC counterparts - and I know quite a lot of people, who use the former to unlock the latter.
Some sanity might just help: This document is important? Encrypt it on a file level and PLEASE close it before letting you computer unsupervised.
On the opposit end of the spectrum, they might have all my "photos" folder. Well, the Memsahib might take issue with that, so not really all.
Yep I think we should all pretty much assume that if someone can get access to our computer (or phone etc.) without our knowledge for a bit, it can be compromised and its data accessed. Now in practice that perhaps isn't true in all cases, but when that's the case it's a bonus and not something you should bet everything on.
I wouldn't rely on a fully shut down computer either. There are potential attacks that might involve swapping out the CPU (at least on x86 hardware where encryption keys are not kept inside the CPU) or even the RAM could be swapped out with DIMMs that include an extra chip with a small CPU and permanent storage that could potentially locate and save a copy of the desired info for later retrieval (stuff like AMD's memory encryption could prevent this, so the window may be closing on this)
Oldskool laptops have case screws under the battery, so the motherboard will always be unpowered when opening the case. We'll depending on the charger socket interfering with opening I guess but that can be achieved. I wonder if there is any legitimate need for the laptop to stay on while open, or should the machine have a simple switch that powers it off when you open the box?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
