New Thunderbolt flaw lets hackers bypass security features in five minutes
Published on: 2020-05-12 22:19:59 | Category: Tips & Tricks | By: admin
In brief: If your laptop gets into the hands of hackers somehow, can the login screen and hard disk encryption keep its contents secure? You might well imagine that, but if it has a Thunderbolt door, you may be in trouble.
With 40Gbps transfer rates and the ability to power computers and connect to 4K peripherals, Intel's Thunderbolt interface works by having more direct access to the memory of a computer than other ports.
One drawback with Thunderbolt 3 is its security issues; because it is insecure, Microsoft says that you won't find the port on Surface devices.
It was revealed last year that a series of security bugs called Thunderclap allowed a hacker with a malicious USB drive to exploit Thunderbolt 's direct access to memory, bypassing all the security measures a device took.
Protecting against Thunderclap can be achieved by disallowing access to untrusted devices or fully shutting off Thunderbolt, but even those precautions can be circumvented by another attack.
As reported by Wired, Eindhoven University of Technology researcher Björn Ruytenberg has revealed a new attack he 's called Thunderspy that can bypass the sleeping login screen or Thunderbolt-enabled computers locked in. It works on both pre-2019 manufactured Windows and Linux PCs, and can even bypass hard disk encryption.
The strategy, which takes less than five minutes, is based on an attacker having time alone with an apparatus known as a "bad maid attack."
"All the evil maid has to do is unwind the backplate, immediately add a battery, reprogram the firmware, reassemble the backplate and the evil maid gets complete access to the laptop," says Ruytenberg.
You can see the attack, which involves opening up a laptop, performed in the video above. The SPI programmer device rewrites the Thunderbolt controller’s firmware, turning off its security settings.