Thunderbolt Ports Vulnerable To Hackers
If a hacker gains physical access to your computer, the Thunderbolt port could be exploited to access the hard disc drive
A security researcher has documented a flaw with the Thunderbolt port found on some computers, that can be hacked to allow attackers access to the hard disc drive (HDD), even if it is encrypted.
The attack, dubbed ‘Thunderspy’ was found by Björn Ruytenberg and concerns the hardware of the port, irrespective of the operating system used by the computer.
However it should be noted that the attackers would need to have physical access to the computer to exploit the vulnerability, begging the question of how serious the flaw will be in the real world.
Thunderspy exploit
“Thunderspy targets devices with a Thunderbolt port,” wrote Ruytenberg. “If your computer has such a port, an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep.”
Ruytenberg warned that Thunderspy works even if a user has followed best security practices by locking or suspending their computer when leaving briefly, and if the system administrator has set up the device with Secure Boot, strong BIOS and operating system account passwords, and enabled full disk encryption.
“All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware,” noted Ruytenberg. “We have found 7 vulnerabilities in Intel’s design and developed 9 realistic scenarios how these could be exploited by a malicious entity to get access to your system, past the defenses that Intel had set up for your protection.”
Ruytenberg said he has developed a free and open-source tool, Spycheck, to determine if a person’s system is vulnerable.
A video of the exploit in action can be found here.
Ruytenberg said that all Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable, although systems shipped from 2019 that come with Kernel DMA Protection are only partially vulnerable.
Intel is apparently increasing the security of its controllers going forward.
Do you know all about security? Try our quiz!
