When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security

To determine whether your system is vulnerable to Thunderspy, we strongly recommend to run our verification tool Spycheck. Alternatively, you can also verify your system manually. Running Windows on a Mac (Boot Camp)? Please refer to affected Apple systems.

Verifying using Spycheck

1. Download and extract the Spycheck ZIP to a folder of your choice. For example, on your Windows desktop, create a new folder named "Spycheck".
2. In the "Spycheck" folder, double-click on the Spycheck icon. At this point, Windows SmartScreen may warn you the program has not been signed and is therefore untrusted. Please confirm you wish to run it.
3. After selecting a language and accepting the open-source GPLv3 license, you will be asked to confirm your system has Thunderbolt ports.
4. At this point, Spycheck will try to detect your system's Thunderbolt controller.
   On some systems, the controller might enter a power saving mode when no Thunderbolt devices are connected. If this is the case with your laptop, please connect a Thunderbolt device to power up the controller. Alternatively, if you don't have any Thunderbolt devices to connect, Spycheck bundles a custom power management driver to enable power to the controller. If you choose to install this driver, please note you may be warned again by Windows SmartScreen. After installing the driver, you may be asked to restart Windows, after which you should run Spycheck again.
5. Finally, Spycheck will show you an analysis summary. A more detailed report is available by clicking on the "Report" button in the summary screen. If you wish, you can then export the report to JSON, or copy the report text to another program of your choice.

Verifying manually

1. Please identify the ports on your system:
   
   
   (i). USB-C or Mini-DisplayPort with lightning symbol
   
   
   (ii). USB-C or Mini-DisplayPort without lightning symbol
   
   If your system provides any ports as pictured in (i), it features Thunderbolt connectivity, and is therefore vulnerable to Thunderspy. Please proceed to the next step. Otherwise, if your system does not provide any ports as pictured in (i), or these look similar to the ports pictured in (ii), then it is not vulnerable to Thunderspy.
   
   
2. Systems purchased before 2019:
   No fix is available. For recommendations on how to help protect your system, please refer to protections against Thunderspy.

   Systems purchased in or after 2019:
   Your system might support Kernel DMA Protection, which partially mitigates Thunderspy. For instructions on how to verify whether your system ships this protection, please refer to Kernel DMA Protection.

To determine whether your system is vulnerable to Thunderspy, we strongly recommend to run our verification tool Spycheck. Alternatively, you can also verify your system manually. Running Linux on a Mac (Boot Camp)? Please refer to affected Apple systems.

Verifying using Spycheck

1. While Spycheck supports running without root privileges, it requires root to generate an accurate report. To verify whether your system is vulnerable to Thunderspy, simply download and run the script as follows ¹:
   

   $ sudo python3 spycheck.py

   
   

   When running Spycheck, you will be asked to identify the ports on your system. If you indicate your system provides Thunderbolt ports, the tool will attempt to detect Thunderbolt hardware and assess whether your system is vulnerable to Thunderspy.

   ¹ To run without root, omit "sudo" from the command line above.
   
   
2. Finally, Spycheck will show you a detailed report. If you wish, you can export the report to JSON by passing "-o FILE.json".

Verifying manually

1. Please identify the ports on your system:
   
   
   (i). USB-C or Mini-DisplayPort with lightning symbol
   
   
   (ii). USB-C or Mini-DisplayPort without lightning symbol
   
   If your system provides any ports as pictured in (i), it features Thunderbolt connectivity, and is therefore vulnerable to Thunderspy. Please proceed to the next step. Otherwise, if your system does not provide any ports as pictured in (i), or these look similar to the ports pictured in (ii), then it is not vulnerable to Thunderspy.
2. Systems purchased before 2019:
   No fix is available. For recommendations on how to help protect your system, please refer to protections against Thunderspy.

   Systems purchased in or after 2019:
   Your system might support Kernel DMA Protection, which partially mitigates Thunderspy. For instructions on how to verify whether your system ships this protection, please refer to Kernel DMA Protection.

All Apple Macs released from 2011 onward, except for Retina MacBooks, provide Thunderbolt connectivity and are therefore vulnerable to Thunderspy. You may wish to learn more about Thunderbolt-equipped Macs on Apple's website. For more information on Apple's position regarding Thunderspy, please refer to why has Apple not fixed Thunderspy.

MacOS

If you are running MacOS, your system is partially affected by Thunderspy. For recommendations on how to help protect your system, please refer to protections against Thunderspy.

Windows and Linux (Boot Camp)

When running any OS other than MacOS, Apple Macs disable all Thunderbolt security. Hence, if you are running Windows or Linux using the Boot Camp utility, your system is fully affected by Thunderspy.

• Connect only your own Thunderbolt peripherals. Never lend them to anybody.
• Avoid leaving your system unattended while powered on, even when screenlocked.
• Avoid leaving your Thunderbolt peripherals unattended.
• Ensure appropriate physical security when storing your system and any Thunderbolt devices, including Thunderbolt-powered displays.
• Consider using hibernation (Suspend-to-Disk) or powering off the system completely. Specifically, avoid using sleep mode (Suspend-to-RAM).

• Disable the Thunderbolt controller entirely in UEFI (BIOS). Please note that this renders all Thunderbolt ports inoperable, including USB and DisplayPort connectivity. However, USB-C charging will most likely remain functioning.

Kernel DMA Protection is Intel's implementation of DMA remapping for Thunderbolt devices. When enabled on supported systems, this protection scheme aims to restrict all Thunderbolt devices to IOMMU-controlled memory ranges. Kernel DMA Protection mitigates some, but not all of the Thunderspy vulnerabilities. While it prevents any further impact on victim system security via DMA, the remaining Thunderspy vulnerabilities expose the system to attacks similar to BadUSB.

If you do not intend to use Thunderbolt, we recommend to disable Thunderbolt in UEFI (BIOS). Otherwise, please proceed below.

Thunderbolt device compatibility

Please note that enabling Kernel DMA Protection is known to cause compatibility issues with a number of Thunderbolt peripherals.

Supported systems

Kernel DMA Protection requires hardware and UEFI (BIOS) support, and is therefore only available on compatible systems shipping from 2019 onward. Hence, all systems released before 2019, and more recent systems that do not ship Kernel DMA Protection, will remain fully vulnerable to Thunderspy forever. If your system does not provide this protection scheme, please refer to protections against Thunderspy instead. You can learn more about Kernel DMA Protection on Microsoft's website.

Verifying whether your system supports Kernel DMA Protection

If you have purchased your Thunderbolt system in or after 2019, it might ship Kernel DMA Protection. Currently, we are aware of support on a limited number of models. Owners of these models may verify support as follows:

• HP EliteBook and ZBook (2019 and later): Power on the system and press F2. In the "Startup Menu" screen, select "BIOS setup (F10)". From the "Advanced" menu, select "System Options". In the screen that follows, verify "DMA Protection" is enabled.
• Lenovo ThinkPad P53, X1 Carbon (2019 and later): Power on the system and press F1. From the "Security" tab, select "Virtualization". In the screen that follows, verify "Kernel DMA Protection" is enabled.
• Lenovo Yoga C940 (models with Ice Lake CPU only): Always enabled by default. Status cannot be queried from UEFI.
• Thunderbolt 4-certified systems: Currently, these include Intel laptop systems equipped with a Tiger Lake or Alder Lake CPU, and Rocket Lake desktops when paired with a Thunderbolt 4 host controller. Please refer to Is Thunderbolt 4 affected? for more information.

If Spycheck reports your system provides Kernel DMA Protection, but does not appear in the former list, please reach out to bjornbjornwebnl using the subject "Thunderspy: new kDMAp system", while attaching Spycheck's JSON report. Thanks!

In our study, we have found Thunderbolt controllers lack handling hardware error conditions when interacting with flash devices. Specifically, we have determined enabling flash write protection (i) prevents changing the Security Level configuration in UEFI, without being reflected in the latter, and (ii) prevents controller firmware from being updated, without such failures being reflected in Thunderbolt firmware update applications. As such, when combined with the fifth issue, this vulnerability allows to covertly, and permanently, disable Thunderbolt security and block all future firmware updates.

Please note that while verification is a straightforward procedure, recovering from this attack may require significant technical expertise, or may not be possible at all. For more information, please refer to our vulnerability report.

Verifying whether you are victim of Thunderspy attack variants 5 and 6

1. In UEFI (BIOS), modify the Thunderbolt Security Level to any value other than "None" (SL0); for example, choose "Secure" (SL2).
2. Reboot to UEFI, and verify the Thunderbolt Security Level is set to the desired value.
3. Continue booting to the OS, and connect any Thunderbolt device.
4. If you are running Windows, navigate to the "About" section of the Thunderbolt Software application, and record the currently active Security Level.
   If you are running Linux, record the currently active Security Level by running:
   

   $ sudo tbtadm topology

   
   In both cases, verify that the currently active Security Level matches the value set in the first step. If it does not match, then your system has become victim to an attacker abusing Thunderspy variants 5 and 6.

Recovering from Thunderspy attack variants 5 and 6

Depending on the exploitation method, recovering from this attack may require significant technical expertise, or may not be possible at all. In carrying out the following instructions, please consult a person with an appropriate technical background. Incorrectly applying any of these instructions may damage your system and/or void its warranty.

• Soft-block method: (i) Using SPIblock, disable block protection on the Thunderbolt controller SPI flash. (ii) Refer to protections against Thunderspy for recommendations on how to help protect your system.
• Hard-block method: (i) Inspect the Thunderbolt controller SPI flash, and desolder any wires from the GND to WP pins. No wires should be visible if the attacker has not used this method. (ii) Using SPIblock, disable write and block protection on the Thunderbolt controller SPI flash. (iii) Refer to protections against Thunderspy for recommendations on how to help protect your system.
• One Time Program method: The SPI flash storing the Thunderbolt controller firmware has been set to an irrevocable read-only state. Therefore, Thunderbolt security will be permanently disabled on your system. No recovery is possible.

• All three versions of Thunderbolt are affected by the Thunderspy vulnerabilities.
• Only systems shipping Kernel DMA Protection mitigate some, not all, of the Thunderspy vulnerabilities.
• Only some systems that began shipping since 2019 come with Kernel DMA Protection.
• Beyond Kernel DMA Protection, Intel will not provide any mitigations to address the Thunderspy vulnerabilities. Hence, Intel will not assign any CVEs to the Thunderspy vulnerabilities, or release any public security advisories to inform the general public.

Despite our repeated efforts, the rationale to Intel's decision not to mitigate the Thunderspy vulnerabilities on in-market systems remains unknown. Given the nature of Thunderspy, however, we believe it would be reasonable to assume these cannot be fixed and require a silicon redesign. Indeed, for future systems implementing Thunderbolt technology, Intel has stated they will incorporate additional hardware protections.

Kernel DMA Protection is only available on a limited number of recent systems. Hence, all systems released before 2019, and more recent systems that do not ship Kernel DMA Protection, will remain fully vulnerable to Thunderspy forever. Please refer to Kernel DMA Protection for more information.

In our vulnerability disclosure procedure, Apple has stated the following:

"Some of the hardware security features you outlined are only available when users run macOS. If users are concerned about any of the issues in your paper, we recommend that they use macOS."

To verify whether your system is affected by Thunderspy, please refer to affected Apple Mac systems.

In our vulnerability disclosure procedure, Intel has not shared why they have chosen not to inform the general public of these issues before. Please refer to the previous question for more information on Intel's position.

In the context of evil maid and supply chain attacks, devices may physically appear to implement USB-C - for example, by its connector not carrying any lightning symbols - while internally hardware may have been tampered with to incorporate a malicious Thunderbolt device instead. This may apply particularly to seemingly innocuous peripherals such as USB-C to DisplayPort/HDMI dongles. To help protect your system against such attacks, consider connecting these devices exclusively using one of the following:

• USB-C female to USB-A male dongles. Connect the device to a USB-A ("regular" USB) port. Optionally, connect the former dongle to a USB-A female to USB-C male dongle, and finally connect the entire chain to a Thunderbolt 3 port. Please note that, if supported by the device, this setup may reduce performance from USB 3.1 Gen 2 (10 Gbps) to USB 3.1 Gen 1 (5 Gbps) speeds, and prevent DP/HDMI signaling.
• USB-C extension cables certified for USB 2.0 or 3.1 Gen 1 speeds. Please note that this setup may reduce performance accordingly. However, DP/HDMI will most likely remain functioning.

Please note: while product descriptions may suggest otherwise, non-Thunderbolt USB-C cables are usually also capable of carrying Thunderbolt signaling. We therefore strongly recommend to avoid cables certified for the following standards:

• USB 3.1 Gen 2 (10 Gbps)
• USB 3.2 Gen 2 (10 Gbps)
• USB 3.2 Gen 2x2 (20 Gbps)

Update 26 January 2021
Starting with Thunderbolt 4, Intel's Thunderbolt certification program requires vendors to implement Kernel DMA Protection. As opposed to Thunderbolt 3, where all systems released before 2019 and various since 2019 will remain fully vulnerable to Thunderspy forever, essentially this means Thunderbolt 4 systems will be the first generation to warrant Kernel DMA Protection support. However, we would like to emphasize Kernel DMA Protection only partially mitigates Thunderspy. Please refer to What is Kernel DMA Protection? for more information.

Previous studies have primarily focused on employing DMA and IOMMU attacks on the PCIe level to compromise Thunderbolt security. Maartmann-Moe (Inception), Frisk (PCILeech) and others have shown Thunderbolt 1 to be a viable entry point in stealing data from encrypted drives and reading and writing all of system memory.

In response, Intel introduced "Security Levels" with Thunderbolt 2, a security architecture designed to protect against all former attacks by enabling users to authorize trusted Thunderbolt devices only. To further strengthen device authentication, the system is said to provide "cryptographic authentication of connections" to prevent devices from spoofing user-authorized devices.

More recent attacks like Thunderclap (Markettos, Rothwell, Gutstein, Pearce, Neumann, Moore, Watson) work within the "Security Levels" ecosystem to attack the IOMMU and do not break Thunderbolt access control. They instead rely on tricking the user into accepting a malicious device as a trusted one. Once enabled, such a device can do a DMA attack similar to without Security Levels.

Our research goes beyond where the current state of the art has ended, by breaking Thunderbolt hardware and protocol security. This is the first attack on Intel's Security Levels. In addition, Intel's response to Thunderclap stated "Existing security options for the Thunderbolt interface also allow you to whitelist trusted Thunderbolt devices to help protect your systems from malicious peripherals" as a remedy to Thunderclap. Our attack, Thunderspy, completely breaks these security options.

Finally, the scope of our work demonstrates how issues residing in one domain (hardware, firmware or software) may lead to compromising security in the other domains.

Stay tuned for Thunderspy 2: Judgment Day.

Update 6 Aug 2020
Today, we are happy to release two tools to patch your system to achieve the same (partial) security that Intel's Kernel DMA Protection offers against Thunderspy. These tools aim to bring Kernel DMA Protection to all systems released between 2013 and 2020 that do not ship Kernel DMA Protection, but are in fact technically capable. Please visit our Thunderspy 2 page for more details. The same fix could be provided systematically by vendors if they update their UEFI (BIOS) distributions.