Thunderbolt Rootkit Vector

← Back to Stories (view on slashdot.org)

Posted by Soulskill on Tuesday December 23, 2014 @07:46AM from the like-USB-but-better dept.

New submitter Holi sends this news from PC World: Attackers can infect MacBook computers with highly persistent boot rootkits by connecting malicious devices to them over the Thunderbolt interface. The attack, dubbed Thunderstrike, installs malicious code in a MacBook's boot ROM (read-only memory), which is stored in a chip on the motherboard. It was devised by a security researcher named Trammell Hudson based on a two-year old vulnerability and will be demonstrated next week at the 31st Chaos Communication Congress in Hamburg.

6 of 163 comments (clear)

Min score:

Reason:

Sort:

Re:uh - by design? by _xeno_ · 2014-12-23 07:56 · Score: 3, Informative

Well, yes, if you can rip open the computer case and install new hardware, you have complete control over the hardware and that's to be expected.
Thunderbolt is more like USB to the user - it's a thing you use to connect untrusted devices to your system. You wouldn't expect that plugging in a USB thumbdrive would magically own your system (well, maybe you should, because it's happened in the past, but I think it's fair to say that it shouldn't). You'd think that plugging in a random Thunderbolt device would be designed to be safe. Apparently not: apparently Thunderbolt is unsafe by design.
The one mitigating factor is that literally no one uses Thunderbolt for anything, so it's not like anyone's likely to be coming across random compromised Thunderbolt devices. Discovering a Thunderbolt device at all would be out of the ordinary.

--
You are in a maze of twisty little relative jumps, all alike.
Re:ROM by Fwipp · 2014-12-23 07:58 · Score: 4, Informative

Well, you're pretty wrong: https://trmm.net/EFI

This allows an attacker with physical access to the machine to write untrusted code to the SPI flash ROM on the motherboard and creates a new class of firmware bootkits for the MacBook systems.
Our proof of concept bootkit also replaces Apple's public RSA key in the ROM and prevents software attempts to replace it that are not signed by the attacker's private key. Since the boot ROM is independent of the operating system, reinstallation of OS X will not remove it. Nor does it depend on anything stored on the disk, so replacing the harddrive has no effect. A hardware in-system-programming device is the only way to restore the stock firmware.
Pretty cool vulnerability but.. by Severus+Snape · 2014-12-23 08:04 · Score: 3, Informative

If I have physical access to your machine, I'm going to get you one way or another.
Re:uh - by design? by maccodemonkey · 2014-12-23 08:05 · Score: 3, Informative

Thunderbolt is more like USB to the user - it's a thing you use to connect untrusted devices to your system. You wouldn't expect that plugging in a USB thumbdrive would magically own your system (well, maybe you should, because it's happened in the past, but I think it's fair to say that it shouldn't). You'd think that plugging in a random Thunderbolt device would be designed to be safe. Apparently not: apparently Thunderbolt is unsafe by design.
USB 3.0 has this exact same feature (DMA), so yes, yes you should expect a USB thumb drive to be able to do this.
Re:uh - by design? by Holi · 2014-12-23 08:10 · Score: 5, Informative

It can. See BadUSB.

--
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
Re:uh - by design? by aitikin · 2014-12-23 09:03 · Score: 3, Informative

The one mitigating factor is that literally no one uses Thunderbolt for anything, so it's not like anyone's likely to be coming across random compromised Thunderbolt devices. Discovering a Thunderbolt device at all would be out of the ordinary.
You're obviously not in the pro audio world.

--
"Don't meddle in the affairs of a patent dragon, for thou art tasty and good with ketchup." ~ohcrapitssteve