APPLE and MICROSOFT PING!
If you want on or off the Apple/Mac/iOS Ping List, Freepmail me.
Posted on 05/11/2020 9:07:49 AM PDT by Swordmaker
Thunderbolt vulnerabilities can let attacker with physical access steal data from memory and encrypted drives.
A Dutch researcher has detailed nine attack scenarios that work against all computers with Thunderbolt shipped since 2011 and which allow an attacker with physical access to quickly steal data from encrypted drives and memory.
Researcher Björn Ruytenberg detailed the so-called Thunderspy attacks in a report published on Sunday, warning that the attacks work even when users follow security best practice, such as locking an unattended computer, setting up Secure Boot, using strong BIOS and operating system account passwords, and enabling full disk encryption.
Microsoft to apply California's privacy law for all US users Mind-reading technology: The security and privacy threats ahead How to replace each Google service with a more privacy-friendly alternative
Microsoft was sufficiently concerned about the vulnerability of Thunderbolt 3 to Direct Memory Access (DMA) attacks that it opted against including it in its Surface devices. Some Windows 10 OEMs have adopted Thunderbolt, while all Apple Mac computers since 2011 include Thunderbolt.
(Excerpt) Read more at zdnet.com ...
I never heard of Thunderbolt, so I guess in won’t affect me.
I think they’re using the wrong kind of locks. What you want is a good lock on the door of the computer room!
If you want on or off the Apple/Mac/iOS Ping List, Freepmail me.
I love my Powermac.
“attacker with physical access steal data from memory and encrypted drives. “
If someone has physical access to any storage media it is vulnerable, sooner or later it gets cracked. This is why you have locked sever rooms. Thunderbolt is pretty good tech very fast and robust.
Possibly true. If you’re a Mac user, your Mac has Thunderbolt ports. So do the Microsoft Surface computers. It’s the fastest peripheral transfer connection. However, Intel apparently made a boo-boo when they designed the original silicon back in 2011 and it’s coming back to bite the standard.
The claim this vulnerability can steal all data is bogus, I think, especially on an encrypted Mac or Mac storage drive. Macs use industry leading 256bit Advanced Encryption Standard to do such encryption which uses a single key that is not available on the device. No matter WHAT peripheral might be plugged into the Thunderbolt port by any vulnerable means cannot magically decrypt the user’s data unless the user has entered their password to decrypt the data. Such a device, no matter what they might be able to install, is also not magic and can be uninstalled, contrary to the article’s claims of locking out further updates. Apple, for example, requires a higher than Super User password to make system level changes to the core software, including firmware. Without that password, any external attempt to change things just cannot occur.
This vulnerability requires physical access to the computer. It is not a remote exploit by any means: a physical device MUST be physically plugged into the computer’s Thunderbolt port before anyone could attempt any break-in.
It was fast as lightning....
oh sorry that was for the kung fu fighting thread
Thanks to Swordmaker for the ping!!
A USB C connector on a laptop is likely Thunderbolt.
Physical access has been "game over" security-wise since before there were computers. If someone has physical access to a computer, or a filing cabinet, there is usually a way to get the data out.
If it's encrypted, they might only get the encrypted data, but they can take it home and work on it at leisure.
Physical security has to come first -- without that, nothing else matters very much.
I was thinking of the ‘64 Fairlanes with the 427 and with the air intakes in place of the outer headlights. Drag racing legendary vehicles.
Better yet THUNDERSUCK for sucking the data out of your computer.
Perfect!
Good one. . . Perhaps it was already taken.
Exactly. Physical access and enough time and you can get into any stored data.
It’s a standard that Apple was an early adopter of- but exists with, as a compliment to- USB technology- currently in USB-C (the standard for most recent smartphone chargers and data cables, and most laptops and desktops). It enables faster data transmission and multiple uses with the same cable. Think ultra HDMI plus the highest speed USB and you get close to understanding it.
But not all USB-C devices also implemented Thunderbolt technology.
Agreed. I have advised our custodial staff - that no one, NO ONE - gets into our telecomm rooms without approval from me or someone in my chain-of-command. I don't care what they say or who they claim to be.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.