Five minutes and a screwdriver were enough. In 2020, security researcher Björn Ruytenberg of Eindhoven University of Technology showed that he could get into a locked, encrypted Windows or Linux laptop without ever learning its password, by opening the case and rewriting the firmware of its Thunderbolt controller.
more
Ruytenberg called the technique Thunderspy. The steps are removing the laptop’s back panel, clipping a small programmer onto the Thunderbolt chip’s pins, and rewriting its firmware so the chip’s built-in security checks read as switched off. Reprogramming the chip took a little over two minutes in his demonstration video, and Ruytenberg said the whole procedure, screws and all, “can be done in under five minutes.” Ars Technica timed its own look at the demonstration at a little more than five minutes, and noted that an attacker would then need extra time to install lasting malware or copy the drive.
Ars Technica put the gear at about $600. Ruytenberg’s own figure was about $400, including an SPI programmer, a clip for the Thunderbolt controller, and a $200 peripheral that carries out the actual memory attack once the chip’s defences are down. Ruytenberg estimated that a well-resourced attacker could shrink the whole kit into a single device for about $10,000, remarking that “three-letter agencies would have no problem miniaturizing this.”
Why disk encryption doesn’t stop it
Thunderbolt ports give connected devices direct access to a computer’s memory, which is what makes them fast for external graphics cards and storage. Ruytenberg found that the security state controlling that access lives in the Thunderbolt chip’s own firmware, and that his tool could rewrite it to “none.” With the chip’s defences off, an attacker can connect a device that switches off the lock screen on a sleeping or locked machine, even one running full-disk encryption. The attack reaches the computer’s memory directly. It never has to ask anyone to type a password into anything.
Intel’s fix, called Kernel DMA Protection, blocks the attack, but it is missing from every Thunderbolt-equipped machine built before 2019 and still is not standard today. Testing by the Eindhoven team found no Dell machine with the protection, 2019 models included, and only a handful of 2019-or-later Lenovo and HP machines that had it. Macs are not vulnerable to Thunderspy, WIRED reported. Ars Technica put that immunity at more than three years old, for as long as the machine keeps running macOS.
Why physical access counts as game over
Security practitioners have a long-standing rule that once someone has held a device alone, even briefly, the safest assumption is that it is compromised. The usual advice is to get rid of the device rather than trust it again, because a firmware rewrite can leave no visible trace, the same approach the NSA-linked Equation Group is known to have used as early as the early 2000s.
Thunderbolt is only one route in. Independent researcher Hector Martin said opening a laptop’s case hands an attacker “tons and tons of things” to try, from the chip that runs the BIOS to the hard drive itself. Karsten Nohl, who runs the hardware security firm SR Labs and also reviewed Ruytenberg’s research, said the finding needs real technical skill and hands-on access to one specific machine, so it should not worry most people. He said he was nonetheless surprised at how easily Intel’s own “security levels” setting could be switched off.
Apple’s laptops have a version of the same problem
In October 2020, a separate group of researchers reported a comparable flaw in the T2 chip that Apple has fitted to its Macs since 2018, including the MacBook Pro, the MacBook Air, and the Mac mini. The researchers worked under the handles @h0m3us3r, @mcmrarm, @aunali1, and Rick Mark. The T2 is built around the same processor Apple used in the iPhone 7, and it holds the Secure Enclave that Macs rely on for Touch ID, encrypted storage, and secure boot.
The researchers adapted checkm8, an exploit first built for jailbreaking iPhones, and combined it with a separate memory controller flaw to compromise the T2 over a suitable USB-C cable, using the public jailbreaking tool checkra1n. The result is root access and the ability to run unsigned code on the chip. That lets an attacker load unauthorised extensions into macOS, read sensitive data, and cancel the remote-lock and firmware-password protections that Apple’s device-management tools and Find My set. It does not open FileVault 2 disk encryption on its own. It does let an attacker install a keylogger to catch the password, or attempt to crack the encryption key by brute force.
Nobody has shown a way to run this attack over a network. It needs a cable in the port, which The Register linked to two familiar evil maid settings: a border crossing and a hotel room. The same access gives law enforcement another way to examine a seized Mac. Apple did not answer The Register’s request for comment.
Why Apple can’t patch it away
The T2 checks its own start-up code against instructions burned into read-only memory at the factory, a safeguard meant to stop anyone from planting malicious code at the very start of the boot chain. Researcher Rick Mark noted that the same safeguard also stops Apple from replacing that code once a device has shipped. A Mac that has already been compromised this way can still be restored, by connecting it in recovery mode to a second machine its owner trusts. Nothing about that fix changes the chip already soldered into every T2 Mac sold since 2018.
