# Thunderbolt flaws left millions of PCs exposed to hackers (HT Tech) > The Thunderspy attack takes less than 5 mins to pull off without even having physical access to the device and can affect ant PC manufactured before 2019 # Thunderbolt flaws left millions of PCs exposed to hackers ## The Thunderspy attack takes less than 5 mins to pull off without even having physical access to the device and can affect ant PC manufactured before 2019 May 12 2020, 15:08 IST ![Follow on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/follow-us-facebook.png) ![Follow on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/follow-us-facebook-hover.png) ![Share](https://images.hindustantimes.com/tech/static/revamp/images/png/Share.png) ![Share](https://images.hindustantimes.com/tech/static/revamp/images/png/Shareclicked.png) ![Share on WhatsApp](https://images.hindustantimes.com/tech/static/revamp/images/png/whatsapp.png) ![Share on WhatsApp](https://images.hindustantimes.com/tech/static/revamp/images/png/whatsapp-hover.png) ![Share on Twitter](https://images.hindustantimes.com/tech/static/revamp/images/png/twitter.png) ![Share on Twitter](https://images.hindustantimes.com/tech/static/revamp/images/png/twitter-hover.png) ![Share on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/facebook.png) ![Share on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/facebook-hover.png) ![Bookmark](https://images.hindustantimes.com/tech/static/revamp/images/png/Bookmark.png) ![Bookmarked](https://images.hindustantimes.com/tech/static/revamp/images/png/Bookmarked.png) ![A collection of flaws in Thunderbolt components known as Thunderclap was revealed by a group of researchers last year that showed that plugging a malicious device into a computer’s Thunderbolt port can quickly bypass all of its security measures.](https://images.hindustantimes.com/tech/rf/image_size_960x540/HT/p2/2020/05/11/Pictures/_2593d4fe-9380-11ea-84fe-62f09e00e282.jpg) A collection of flaws in Thunderbolt components known as Thunderclap was revealed by a group of researchers last year that showed that plugging a malicious device into a computer’s Thunderbolt port can quickly bypass all of its security measures. (YouTube) ![Author Photo](https://images.hindustantimes.com/tech/static/revamp/images/png/HTTech-new-circle-logo.png) ### By HINDUSTANTIMES.COM | EDITED BY JHINUK SEN A laptop left alone with a hacker for more than a few minutes should be considered compromised, security paranoiacs have warned for years. Now a Dutch researcher has shown how "that sort of physical access hacking can be pulled off in an ultra-common component - the Intel Thunderbolt port found in millions of PCs". A researcher from Eindhoven University of Technology, Björn Ruytenberg, revealed the details of a new attack method he's calling Thunderspy. On Thunderbolt-enabled Windows or Linux PCs that have been manufactured before 2019, Thunderspy can "bypass the login screen of a sleeping or locked computer—and even its hard disk encryption—to gain full access to the computer's data". While Ruytenbetg's attack "may require opening a target laptop's case with a screwdriver, it leaves no trace of intrusion, and can be pulled off in just a few minutes. Also read click here. This opens the new avenue to something the security industry calls "evil maid attack", which is basically a threat every time a hacker gets some alone time with a computer in a hotel room, for instance. "Ruytenberg says there's no easy software fix, only disabling the Thunderbolt port altogether," Wired explains. "All the evil maid needs to do is unscrew the backplate, attach a device momentarily, reprogram the firmware, reattach the backplate, and the evil maid gets full access to the laptop," says Ruytenberg. The researcher plans to present his Thunderspy at the Black Hat security conference this summer. "All of this can be done in under five minutes." Security researchers have long been wary of Intel's Thunderbolt interface as a potential security issue, writes Wired. "It offers faster speeds of data transfer to external devices in part by allowing more direct access to a computer's memory than other ports, which can lead to security vulnerabilities". A collection of flaws in Thunderbolt components known as Thunderclap was revealed by a group of researchers last year that showed that plugging a malicious device into a computer's Thunderbolt port can quickly bypass all of its security measures. As a remedy, those researchers recommended "that users take advantage of a Thunderbolt feature known as 'security levels', disallowing access to untrusted devices or even turning off Thunderbolt altogether in the operating system's settings. That would turn the vulnerable port into a mere USB and display port". Ruytenberg's new technique allows "an attacker to bypass even those security settings, altering the firmware of the internal chip responsible for the Thunderbolt port and changing its security settings to allow access to any device. It does so without creating any evidence of that change visible to the computer's operating system". "Intel created a fortress around this," says Tanja Lange, a cryptography professor at the Eindhoven University of Technology and Ruytenberg's advisor on the Thunderspy research. "Björn has gotten through all their barriers." After last year's Thunderclap research, Intel has created a security mechanism known as Kernel Direct Memory Access Protection, which prevents Ruytenberg's Thunderspy attack. However, that Kernel DMA Protection is lacking in all computers made before 2019, and is still not standard today. In fact, many Thunderbolt peripherals made before 2019 are incompatible with Kernel DMA Protection. "In their testing, Eindhoven researchers could find no Dell machines that have the Kernel DMA Protection, including those from 2019 or later, and they were only able to verify that a few HP and Lenovo models from 2019 or later use it,"" Wires wrote. Computers running Apple's MacOS are unaffected. Ruytenberg is also releasing a tool to determine if your computer is vulnerable to the Thunderspy attack, and whether it's possible to enable Kernel DMA Protection on your machine. Ruytenberg's technique "requires unscrewing the bottom panel of a laptop to gain access to the Thunderbolt controller, then attaching an SPI programmer device with an SOP8 clip, a piece of hardware designed to attach to the controller's pins. That SPI programmer then rewrites the firmware of the chip—which in Ruytenberg's video demo takes a little over two minutes—essentially turning off its security settings". "I analysed the firmware and found that it contains the security state of the controller," Ruytenberg says. "And so I developed methods to change that security state to 'none.' So basically disabling all security." An attacker can then plug a device into the Thunderbolt port that alters its operating system to disable its lock screen, even if it's using full disk encryption, Wired explained. The full attack Ruytenberg shows in his demo video uses only about $400 dollars-worth of equipment, but requires an SPI programmer device and a $200 peripheral that can be plugged into a Thunderbolt port to carry out the direct memory attack that bypasses the lockscreen, like the AKiTiO PCIe Expansion Box Ruytenberg used. Ruytenberg argues that a better-funded hacker could build the entire setup into a single small device for around $10,000. The fact that Thunderbolt remains a viable attack method for evil maids isn't entirely unexpected, says Karsten Nohl, a well-known hardware security researcher and founder of SR Labs, who reviewed Ruytenberg's work. But Nohl said that it should not freak out too many users since it requires a certain level of sophistication and physical access to a victim machine. Nohl, however, was still surprised to see how easily Intel's "security levels" can be bypassed. "If you're adding an authentication scheme against hardware attacks and then you implement it in unsecured hardware...that's the wrong way to tackle a hardware security problem," says Nohl. "It's a false sense of protection." "Ruytenberg says there's also a less invasive version of his Thunderspy attack, but it requires access to a Thunderbolt peripheral the user has plugged into their computer at some point. Thunderbolt devices set as 'trusted' for a target computer contain a 64-bit code that Ruytenberg found he could access and copy from one gadget to another. That way he could bypass a target device's lockscreen without even opening the case". "There's no real cryptography involved here," Ruytenberg says. "You copy the number over. And that's pretty much it." However, that version of the Thunderspy attack only works, when the Thunderbolt port's security settings are configured to their default setting of allowing trusted devices. Ruytenberg shared his findings with Intel three months ago. When Wired reached out to the company, Intel responded with a blog post noting - "While the underlying vulnerability is not new, the researchers demonstrated new physical attack vectors using a customized peripheral device". "In 2019, major operating systems implemented Kernel Direct Memory Access (DMA) protection to mitigate against attacks such as these. This includes Windows (Windows 10 1803 RS4 and later), Linux (kernel 5.x and later), and MacOS (MacOS 10.12.4 and later)," the blog added. "For all systems, we recommend following standard security practices," Intel added, "including the use of only trusted peripherals and preventing unauthorized physical access to computers." Catch all the Latest Tech News, Mobile News, Laptop News, Gaming news, Wearables News , How To News, also keep up with us on Whatsapp channel,Twitter, Facebook, Google News, and Instagram. For our latest videos, subscribe to our YouTube channel. 11 May, 17:40 IST 71,589,384,322,280 NEXT ARTICLE BEGINS ![View all](https://images.hindustantimes.com/tech/static/revamp/images/png/view-all-icon.png) ## Tips & Tricks ![Ghibli-style art](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### How to turn your photos into Ghibli-style art with ChatGPT for free: Step-by-step guide ![How to create an invitation using iPhone’s new Apple Invites app- Step-by-step guide](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### How to create an invitation using iPhone’s new Apple Invites app- Step-by-step guide ![Apple TV app arrives on Android phones and tablets: What you get and how to install it](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Apple TV app arrives on Android phones and tablets: What you get and how to install it ![Vodafone Idea OTT plans](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Vodafone Idea users can now stream 17 OTT apps with one subscription: Here's how ![Android data transfer methods](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### How to transfer data from one Android to another using Google backup, USB-C cable, and more ## Editor’s Pick ![iPhone 16e launched with A18 chip, Apple AI—bringing flagship power on a budget: Check specs, price](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### iPhone 16e launched in India: All details about the new budget mobile from Apple ![DeepSeek was founded in China with only a fraction of the budget of the top AI companies in the US.](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### DeepSeek AI: How it works, who’s behind it, how it’s different from ChatGPT, and its big US market impact explained ![iPhone 17 Air likely to get this feature that iPhone 17 Pro models may miss out on](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### iPhone 17 Air likely to get this feature that iPhone 17 Pro models may miss out on ![Google Whisk AI explained: How remixing works, availability, and how it differs from Gemini](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Google Whisk AI explained: How remixing works, availability, and how it differs from Gemini ![iOS 18.4 beta arriving soon: Know why it is the biggest iPhone update](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### iOS 18.4 beta arriving soon: Know why it is the biggest iPhone update ## Trending Stories ![Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order ![Infinix Note 50s 5G+](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Infinix Note 50s 5G+ set to launch in India with 64MP camera and MediaTek Dimensity 7300 SoC ![Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more ![Apple Intelligence AI training](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Apple plans to train AI using your on-device data without accessing personal content or emails: Report ![CMF Buds 2](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### CMF Buds 2 key features and price revealed ahead of April 28 launch: Details inside keep up with tech ![Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-facebook.png) ![Twitter](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-twitter.png) ![WhatsApp](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-whatsApp.png) ![Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-facebook.png) ## Gaming ![Check out these five gaming monitors under ₹20,000,](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Top 5 gaming monitors under ₹20000 you should consider ![gaming consoles](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Grab gaming consoles at discounted rates during Amazon Great Indian Festival: Up to 72% off ![Pokémon GO Wild Area 2025](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Pokémon GO Wild Area 2025 to bring Grimmsnarl family, Shiny Hatenna, and global challenges ![Shade Silver](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Shade Silver free on Steam for a limited time: Here’s how to get it ![Call of duty](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Call of Duty: Black Ops 7 skips Switch 2 at launch, release date and price leak ![View all](https://images.hindustantimes.com/tech/static/revamp/images/png/view-all-icon.png) ## Trending News ### Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order ![Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order](https://images.livemint.com/static/static/1x1_img.gif) ### Infinix Note 50s 5G+ set to launch in India with 64MP camera and MediaTek Dimensity 7300 SoC ![Infinix Note 50s 5G+](https://images.livemint.com/static/static/1x1_img.gif) ### Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more ![Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more](https://images.livemint.com/static/static/1x1_img.gif) ### Apple plans to train AI using your on-device data without accessing personal content or emails: Report ![Apple Intelligence AI training](https://images.livemint.com/static/static/1x1_img.gif) ### CMF Buds 2 key features and price revealed ahead of April 28 launch: Details inside ![CMF Buds 2](https://images.livemint.com/static/static/1x1_img.gif) ## Trending Gadgets Mobiles Laptops Tablets ![HT Tech](https://images.hindustantimes.com/tech/static/revamp/images/png/HT_tech-new.gif) - https://tech.hindustantimes.com/tech/news/thunderbolt-flaws-left-millions-of-pcs-exposed-to-hackers-story-e0nGk17IoYUxC5KUkX366K.html