Thunderbolt Vulnerabilities Affect Millions of Devices

Summary

Researcher Björn Ruytenberg discovered several vulnerabilities in Thunderbolt-equipped systems, including Mac, Linux, and Windows devices. Threat actors could exploit these vulnerabilities by reading and copying data with brief physical access to the system, a screwdriver, and easily portable hardware to access system memory — even if the device has full disk encryption, Secure Boot, strong BIOS and operating system account passwords, and other best practices employed. Remediating the vulnerabilities would require a silicon redesign; however, there is a Spycheck tool to verify affected systems before following the recommendations provided by Spycheck.

Recommendations

The NJCCIC recommends users adopt a defense-in-depth cybersecurity strategy and maintain cybersecurity best practices, including physical security. More detailed information and demo can be found in the Thunderspy report and the ZDNet article.