Thunderbolt Ports Vulnerable To Hackers

A security researcher has documented a flaw with the Thunderbolt port found on some computers, that can be hacked to allow attackers access to the hard disc drive (HDD), even if it is encrypted.

The attack, dubbed ‘Thunderspy’ was found by Björn Ruytenberg and concerns the hardware of the port, irrespective of the operating system used by the computer.

However it should be noted that the attackers would need to have physical access to the computer to exploit the vulnerability, begging the question of how serious the flaw will be in the real world.

Thunderspy exploit

“Thunderspy targets devices with a Thunderbolt port,” wrote Ruytenberg. “If your computer has such a port, an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep.”

Ruytenberg warned that Thunderspy works even if a user has followed best security practices by locking or suspending their computer when leaving briefly, and if the system administrator has set up the device with Secure Boot, strong BIOS and operating system account passwords, and enabled full disk encryption.

“All the attacker needs is 5 minutes alone with the computer, a screwdriver, and some easily portable hardware,” noted Ruytenberg. “We have found 7 vulnerabilities in Intel’s design and developed 9 realistic scenarios how these could be exploited by a malicious entity to get access to your system, past the defenses that Intel had set up for your protection.”

Ruytenberg said he has developed a free and open-source tool, Spycheck, to determine if a person’s system is vulnerable.

A video of the exploit in action can be found here.

Ruytenberg said that all Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable, although systems shipped from 2019 that come with Kernel DMA Protection are only partially vulnerable.

Intel is apparently increasing the security of its controllers going forward.

Do you know all about security? Try our quiz!

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

NHS Covid-19 Tracing App For England, Wales, Nears Launch

Date for limited rollout of delayed NHS track and trace app for England and Wales…

2 days ago

Coronavirus: Facebook Staff To Work From Home Until July 2021

Facebook follows Google lead by extending right of staffers to work from home until July…

2 days ago

Canon Suffers Ransomware Attack, With 10TB Of Data Stolen – Report

Report suggests Canon has been crippled with a ransomware attack with allegedly 10TB of data,…

3 days ago

Uber Expands UK Reach With Autocab Buy

Amid consolidation in the taxi sector caused by Coronavirus lockdown, Uber purchases British rival Autocab…

3 days ago

TikTok Selects Ireland For First European Data Centre

Ireland to get another data centre after the Chinese-owned short video app TikTok announces first…

3 days ago