Thunderspy: An Unpatchable Thunderbolt Security Exploit

A security researcher has discovered a Thunderbolt vulnerability that could allow attackers to bypass system defenses and access the contents of a locked computer's drive in minutes. The new exploit has been dubbed Thunderspy. With just a few minutes of physical access and a couple of hundred dollars of easily purchased equipment, an attacker could bypass a computer's security mechanisms even if it's locked and can encrypt the hard drive. The vulnerability affects all Thunderbolt-equipped machines manufactured before 2019, although macOS devices are only "partially affected." Although exploitation is simple to achieve, it is important to note that physical access is required for successful exploitation. Typically, exploits that require physical access are unlikely to be exploited at-scale. However, in this case, Thunderspy can be used even if the target machine is locked or asleep, making exploitation much more likely than typically is the case.

Recommendations

If you intend to use Thunderbolt connectivity:

Connect only your own Thunderbolt peripherals. Never lend them to anybody.
Avoid leaving your system unattended while powered on, even if the screen is locked.
Avoid leaving your Thunderbolt peripherals unattended.
Ensure appropriate physical security when storing your system and any Thunderbolt devices, including Thunderbolt-powered displays.
Consider using hibernation (Suspend-to-Disk) or powering off the system completely. Specifically, avoid using sleep mode (Suspend-to-RAM).

If you do not intend to use Thunderbolt, we strongly recommend to:

Disable the Thunderbolt controller entirely in UEFI (BIOS). Please note that this renders all Thunderbolt ports inoperable, including USB and DisplayPort connectivity. However, USB-C charging will most likely remain functioning.

Details

Thunderbolt is a high-bandwidth interconnect promoted by Intel and included in laptops, desktops, and other systems. The Thunderspy exploit targets devices with a Thunderbolt port. If your computer has such a port, an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted or if your computer is locked or set to sleep.

Thunderspy enables the creation of arbitrary Thunderbolt device identities and the cloning of user-authorized Thunderbolt devices, even in the presence of Security Levels pre-boot protection and cryptographic device authentication. The exploit can also be used to disable Thunderbolt security and any future firmware updates, increasing the victim’s risk of further future exploitation.

Am I affected?

No fix is available for systems purchased before 2019.
For systems purchased in or after 2019, Kernel DMA protection may be available. This partially mitigates Thunderspy. Some information may still be accessible.
Apple devices running macOS are partially vulnerable to Thunderspy. Apple devices running Windows or Linux are fully vulnerable to Thunderspy.

Conclusion

All Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable. Some systems providing Kernel DMA Protection are partially vulnerable, however some information remains accessible. The Thunderspy vulnerabilities cannot be fixed. In order to mitigate risk, ZeroFOX advises that machines with sensitive information never be let out of the users sight, particularly in public places. When traveling, devices should always be taken in carry on bags. When in public places, devices should never be left unattended, even if they are locked. Taking caution to watch over devices that may be lucrative targets will help prevent potentially sensitive information from being compromised.