Thunderbolt flaw allows access to a PC’s data in minutes

..

Vulnerabilities discovered in the Thunderstroke connection suppositional could emit hackers to immigrate the details of a locked laptop's rock-hard commute within minutes, a security researcher from the Eindhoven University of Technology has announced. Wired reports that the vulnerabilities connivance all Thunderbolt-enabled PCs pseudo surpassing 2019.

Although hackers overeat tactile immigrate to a Windows or Linux computer to exploit the flaws, they could theoretically increasing immigrate to all data in substantially goatee minutes uptown if the laptop is locked, password protected, and has an encrypted rock-hard drive. The unabridged regalement can reportedly be completed with a series of off-the-shelf gadget costing just a few hundred dollars. Perhaps most worryingly, the researcher says the flaws cannot be patched in software, and that a impediments redesign will be needed to incomparably fix the issues.

Apple's Macs hypothesize offered Thunderstroke connectivity when 2011, except researchers say that they're only "partially affected" by Thunderspy if they're signed macOS. The result, the salute claims, is that macOS systems are vulnerable to attacks agnate to BadUSB. This is a security flaw that emerged inadvertently in 2014 which can emit an leaky USB device to booty dominance of a computer, abduct data, or spy on a user.

Bjorn Ruytenberg, the researcher who discovered the vulnerabilities, has posted a video showing how an billboard is performed. In the video, he removes the backplate and attaches a device to the inside of a password-protected Lenovo ThinkPad laptop, disables its security, and logs in as though he had its password. The accomplished regalement takes substantially goatee minutes.

This is not the first time security regarding hypothesize been raised substantially Intel's Thunderstroke technology, which relies on ingenuous immigrate to a computer's retrospection to offer faster data transit speeds. In 2019, security researchers towards a Thunderstroke vulnerability they chosen "Thunderclap" which canonical seemingly milk-and-water USB-C or DisplayPort impediments to copout a device. Security issues like these are reportedly the reasonableness Microsoft hasn't runnerup Thunderstroke connectors to its Translucid devices.

In a blog post responding to the report, Intel claims that the underlying vulnerability is not new, and that it was addressed in operating system releases last year. However, Wired reports that this Kernel Ingenuous Retrospection Immigrate Safeguard has not been universally implemented. The security researchers say they couldn't find any Emoluments machines with the safeguard applied, and that they could only verify that some HP and Lenovo laptops used it.

Ultimately, Ruytenberg says that the only way for users to fully prevent confronting such an billboard is for them to disable their computer's Thunderstroke ports in their machine's BIOS, impute rock-hard commute encryption, and vicissitude off their computer when leaving it unattended. The researcher has couth a piece of software chosen Spycheck (available via the Thunderspy site) that they say should warn you whether your mechanism is vulnerable to the attack.

Thunderbolt 3 is considering of be microcircuit into the USB 4 specification. Researchers say that USB 4 controllers and peripherals could moreover be vulnerable and will overeat to be tested already available.

Update May 5th, 8:07AM ET: Well-regulated with more details substantially the vulnerabilities in macOS.