A newly discovered vulnerability behind the Thunderbolt port on recent Macs or PCs could leave your computer exposed to an attack. Essentially, when a malicious accessory is plugged into a Thunderbolt port, hackers may be able to gain access to your files and steal data.
Researchers revealed the Thunderclap vulnerability at the Network and Distributed System Security Symposium, showing how direct memory access, or DMA, used by Thunderbolt ports to speed up access to memory puts your computers at risk. In addition to Thunderbolt ports, the researchers say that the vulnerability also affects a slew of other ports that take advantage of the low-level memory access privilege, including Firewire, Thunderbolt 2 and 3, and USB-C.
While DMA risks have been previously known, designers built in Input-Output Memory Management Units, (IOMMUs) as safeguards. The way this works, according to Sophos’ Naked Security blog, is that “access is granted through a virtual address space managed by the operating system in conjunction with hardware Input-Output Memory Management Units.”
However, IOMMUs aren’t quite as effective as previously thought. When a hacker plugs in a compromised peripheral that contains malicious code, there are ways to bypass the IOMMU layer. “These vulnerabilities allow an attacker with physical access to a Thunderbolt port to compromise a target machine in a matter of seconds, running arbitrary code at the highest privilege level and potentially gaining access to passwords, banking logins, encryption keys, private files, browsing, and other data,” the blog reported.
Researchers discovered the vulnerability by building their own device called the Thunderclap, hence the name behind the vulnerability. Any computer with a Thunderbolt port, including systems running Windows, Linux, FreeBSD, and Apple’s MacOS, is at risk, though researchers cautioned that any computer with a compromised PCIe card could also be affected.
Makers of operating systems were warned about the findings in 2016 and the latest software updates to MacOS, Windows 10, and Linux have removed some of the risks associated with this type of attack, but PCIe cards still aren’t safe.
However, to reduce your risk even further, you should refrain from using public or uncertified USB-C chargers and avoid plugging in any peripheral or accessory that you’re not familiar with.
